redash vulnerabilities
CVEs whose affected-version data names the redash package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-77371Critical· 9.3PoCRedash is a package for data visualization and sharing
Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of tru…
CVE-2026-76083Medium· 4.9Redash is a package for data visualization and sharing
Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/query_runner/json_ds.py used _get_all_results() to combine its configured base_url with a user-supplied query U…
CVE-2026-42093High· 8.7PoCRedash is a package for data visualization and sharing
Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-contr…