Threat database

Redash versions from 26.0.0 up to but not including 26.9.0 contain an improper access control vulnerability in the DuckDB query runner. This flaw allows users with query access to an administrator-created DuckDB data source to read or write files on the server with the privileges of the Redash process. Sensitive application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could be exposed, potentially enabling session forgery and authentication bypass. The issue is resolved in version 26.9.0.

A Server-Side Request Forgery (SSRF) vulnerability exists in redash versions from 10.0.0 up to but not including 26.9.0. The JSON data source query runner improperly combines a configured base URL with a user-supplied query URL, allowing an absolute URL to override the base URL. This enables users with execute_query permission to make server-side requests to arbitrary external origins. If HTTP Basic Authentication is configured, credentials may be forwarded to these external origins. Private IP blocking can be enforced via REDASH_ENFORCE_PRIVATE_IP_BLOCK. The issue is fixed in version 26.9.0.

CVE-2026-42093 is a high-severity SQL injection vulnerability in the Redash data visualization package. It affects versions after 8.0.0 up to but not including 26.9.0. The flaw arises from improper handling of certain query parameters in the Query Results query runner, allowing authenticated users with view-only access to inject SQL commands and execute them with elevated privileges. This issue is fixed in version 26.9.0.

Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the get_next_path() function in Redash's authentication module stripped the scheme and netloc from user-supplied next parameters but did not normalize multiple leading slashes, allowing a crafted login URL such as /login?next=////evil.com to redirect users to an external attacker-controlled site after authentication.