{"id":"CVE-2026-77371","title":"Redash is a package for data visualization and sharing","summary":"Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of tru…","severity":"critical","cvss":9.3,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N","cwe":["CWE-284"],"vendor":"getredash","product":"redash","affected":["redash >= 26.0.0, < 26.9.0"],"published":"2026-10-14","updated":"2026-10-16","sourceUpdated":"2026-10-16T16:00:33.533","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-77371","references":[{"url":"https://github.com/getredash/redash/commit/7387072af40913a64e7b3be470491792f2d5551c","label":"security-advisories@github.com"},{"url":"https://github.com/getredash/redash/releases/tag/v26.9.0","label":"security-advisories@github.com"},{"url":"https://github.com/getredash/redash/security/advisories/GHSA-cr68-3xxj-cg9f","label":"security-advisories@github.com"},{"url":"https://github.com/getredash/redash/security/advisories/GHSA-cr68-3xxj-cg9f","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"epss":0.00525,"epssPercentile":0.44308,"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-10-14T19:35:55.829497Z"},"cvssSource":"cna","ingestedAt":"2026-10-14T18:47:39.316Z","slug":"CVE-2026-77371","body":"## Overview\n\nRedash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":63,"depthScoreParts":{"impact":51.2,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":221880,"id":"CVE-2026-77371","ts":1792035891168,"field":"exploit_available","old":"false","new":"true"},{"seq":221879,"id":"CVE-2026-77371","ts":1792035891168,"field":"cvss","old":null,"new":"9.3"},{"seq":221878,"id":"CVE-2026-77371","ts":1792035891168,"field":"severity","old":"none","new":"critical"}]}