Advisories · Technology

redash.

Every CVE that names redash among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-77371 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access
- redash
- Broken access control
Not analysed yet 14 Oct 2026
CVE-2026-76083 CVE record

CVSS 4.9 Medium

Redash: JSON data source query URL can bypass base URL restriction
- redash
- Server-side request forgery (SSRF)
Not analysed yet 14 Oct 2026
CVE-2026-42093 CVE record

CVSS 8.7 High

Redash: SQL Injection via Query Results parameterized query substitution
- redash
- SQL injection
Not analysed yet 14 Oct 2026
CVE-2026-33213 CVE record

CVSS 6.1 Medium

Redash: Open redirect vulnerability in post-login redirect handling
- redash
- Open redirect
Not analysed yet 15 Jul 2026
CVE-2025-5874 CVE record

CVSS 2.1 Low

Redash getattr python.py run_query sandbox
- Redash
- CWE-264
- CWE-265
Not analysed yet 9 Jun 2025
CVE-2021-43780 CVE record

CVSS 6.8 Medium

Server-Side Request Forgery (SSRF) in Redash
- redash
- Server-side request forgery (SSRF)
Not analysed yet 23 Nov 2021
CVE-2021-41192 CVE record

CVSS 8.1 High

Insecure default configuration
- redash
- CWE-1188
Not analysed yet 23 Nov 2021
CVE-2021-43777 CVE record

CVSS 6.8 Medium

Vulnerability in Redash OAuth2 flows due to misuse of state field (should be a nonce)
- redash
- Cross-site request forgery (CSRF)
Not analysed yet 23 Nov 2021