Vulnerability details
CVE-2026-77371
getredash redash
Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access
CVSS 4.0
9.3Critical
Official description
Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| getredash | redash | >= 26.0.0, < 26.9.0 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://github.com/getredash/redash/commit/7387072af40913a64e7b3be470491792f2d5551c x_refsource_MISC
- https://github.com/getredash/redash/releases/tag/v26.9.0 x_refsource_MISC
- https://github.com/getredash/redash/security/advisories/GHSA-cr68-3xxj-cg9f x_refsource_CONFIRM
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-14
- Last updated
- 2026-10-14
- State
- Published
- Assigner (CNA)
- GitHub_M
- Kolun priority
- 25 · Low
Exploit prediction (EPSS)
0.52%
Probability of exploitation in 30 days
44.6%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- No
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-284Improper Access Control