Critical
Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access
Type: advisorySources: OSV
Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-77371
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 20:24 UTC · Revision 1
Source evidence
Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access
core-osv · Original sourcePublished 14 Oct 2026, 18:02 UTC
Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.
osv:CVE-2026-77371
Complete source record
{
"id": "c57f9e2bf0cfec94e278390faa69e36e3ef02b0919eee89d46eee27ee50cf773",
"url": "https://osv.dev/vulnerability/CVE-2026-77371",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access",
"summary": "Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.",
"evidence": "osv:CVE-2026-77371",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2026-77371",
"aliases": [
"CVE-2026-77371",
"GHSA-cr68-3xxj-cg9f"
],
"metrics": [
{
"type": "CVSS_V4",
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/getredash/redash",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "42fdf9d4a0fdb83841130ab78f69899a224f281b"
},
{
"fixed": "7387072af40913a64e7b3be470491792f2d5551c"
}
],
"database_specific": {
"extracted_events": [
{
"range": [
{
"introduced": "26.0.0"
},
{
"fixed": "26.9.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StringRangeExpression"
},
{
"range": [
{
"fixed": "7387072af40913a64e7b3be470491792f2d5551c"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "42fdf9d4a0fdb83841130ab78f69899a224f281b"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v26.9.0"
}
]
}
}
],
"versions": [
"26.09.0-dev",
"26.08.0-dev",
"26.07.1-dev",
"26.07.0-dev",
"26.06.0-dev",
"26.05.0-dev",
"26.04.0-dev",
"26.03.0-dev",
"26.02.0-dev",
"26.01.0-dev",
"25.12.0-dev",
"25.11.0-dev",
"25.10.0-dev",
"25.09.0-dev",
"25.08.0-dev",
"25.07.0-dev",
"25.06.0-dev",
"25.05.0-dev",
"25.04.0-dev",
"25.03.0-dev",
"25.02.0-dev",
"25.01.0-dev",
"24.12.0-dev",
"24.11.0-dev",
"24.10.0-dev",
"24.09.0-dev",
"24.08.1-dev",
"24.08.0-dev",
"24.07.0-dev",
"24.06.0-dev",
"24.05.0-dev",
"24.04.0-dev",
"24.03.0-dev",
"23.12.0-dev",
"23.11.0-dev",
"23.10.0-dev",
"23.09.0-dev",
"v6.0.0-beta",
"v5.0.0",
"v4.0.1",
"v5.0.0-beta",
"v4.0.0",
"v4.0.0-rc.1",
"v4.0.0-beta",
"v3.0.0",
"v2.0.0",
"v1.0.3",
"v1.0.1",
"v1.0.2",
"v1.0.0-rc.2",
"v1.0.0-rc.1",
"v0.12.0.b2449",
"v0.11.0.b2016",
"v0.10.0.b1774",
"v0.11.0-rc",
"v0.9.2.b1536",
"v0.9.2-rc",
"v0.9.1.b1377",
"v0.9.1-rc",
"v0.9.0.b1363",
"v0.9.0-rc",
"v0.8.3.b1192",
"v0.8.3-rc",
"v0.8.2.b1181",
"v0.8.2-rc",
"v0.8.1.b1110",
"v0.8.1-rc",
"v0.8.0.b1058",
"v0.8.0-rc",
"v0.7.1.b1015",
"v0.7.1-rc",
"0.7.0",
"v0.7.0-rc",
"v0.6.4-rc",
"v0.6.3.b906",
"v0.6.2.b887",
"v0.6.2-rc",
"v0.6.3-rc",
"v0.6.1.b885",
"v0.6.1-rc",
"v0.6.0.b812",
"v0.6.0+b767",
"v0.6.0+b762",
"v0.6.0+b760",
"v0.6.0+b759",
"v0.6.0+b748",
"v0.6.0+b746",
"v0.6.0+b737",
"v0.6.0+b735",
"v0.6.0+b733",
"v0.6.0+b731",
"v0.6.0+b729",
"v0.6.0+b727",
"v0.6.0+b723",
"v0.6.0+b722",
"v0.6.0+b720",
"v0.6.0+b718",
"v0.6.0+b716",
"v0.6.0+b714",
"v0.6.0+b711",
"v0.6.0+b710",
"v0.6.0+b709",
"v0.6.0+b707",
"v0.6.0+b705",
"v0.6.0+b703",
"v0.5.0+b696",
"v0.5.0+b690",
"v0.5.0+b689",
"v0.5.0+b685",
"v0.5.0+b683",
"v0.5.0+b681",
"v0.5.0+b680",
"v0.5.0+b679",
"v0.5.0+b678",
"v0.5.0+b676",
"v0.5.0+b674",
"v0.5.0+b670",
"v0.5.0+b666",
"v0.5.0+b664",
"v0.5.0+b661",
"v0.5.0+b656",
"v0.5.0+b655",
"v0.5.0+b654",
"v0.5.0+b652",
"v0.5.0+b650",
"v0.5.0+b648",
"v0.4.0+b641",
"v0.4.0+b636",
"v0.4.0+b640",
"v0.4.0+b634",
"v0.4.0+b632",
"v0.4.0+b630",
"v0.4.0+b623",
"v0.4.0+b629",
"v0.4.0+b628",
"v0.4.0+b627",
"v0.4.0+b622",
"v0.4.0+b620",
"v0.4.0+b618",
"v0.4.0+b614",
"v0.4.0+b608",
"v0.4.0+b606",
"v0.4.0+b604",
"v0.4.0+b602",
"v0.4.0+b595",
"v0.4.0+b591",
"v0.4.0+b589",
"v0.4.0+b588",
"v0.4.0+b587",
"v0.4.0+b585",
"v0.4.0+b573",
"v0.4.0+b582",
"v0.4.0+b568",
"v0.4.0+b567",
"v0.4.0+b581",
"v0.4.0+b564",
"v0.4.0+b563",
"v0.4.0+b549",
"v0.4.0+b562",
"v0.4.0+b560",
"v0.4.0+b559",
"v0.4.0+b556",
"v0.4.0+b555",
"v0.4.0+b554",
"v0.4.0+b552",
"v0.4.0+b546",
"v0.4.0+b544",
"v0.4.0+b542",
"v0.4.0+b538",
"v0.4.0+b537",
"v0.4.0+b536",
"v0.4.0+b534",
"v0.4.0+b532",
"v0.4.0+b531",
"v0.4.0+b528",
"v0.4.0+b525",
"v0.4.0+b522",
"v0.4.0+b521",
"v0.4.0+b518",
"v0.4.0+b514",
"v0.4.0+b513",
"v0.4.0+b510",
"v0.4.0+b508",
"v0.4.0+b489",
"v0.4.0+b507",
"v0.4.0+b500",
"v0.4.0+b498",
"v0.4.0+b493",
"v0.4.0+b491",
"v0.4.0+b484",
"v0.4.0+b480",
"v0.4.0+b453",
"v0.4.0+b449",
"v0.4.0+b447",
"v0.4.0+b445",
"v0.4.0+b444",
"v0.4.0+b442",
"v0.4.0+b440",
"v0.4.0+b438",
"v0.4.0+b437",
"v0.4.0+b436",
"v0.4.0+b435",
"v0.4.0+b433",
"v0.4.0+b431",
"v0.4.0+b429",
"v0.4.0+b427",
"v0.4.0+b424",
"v0.4.0+b426",
"v0.4.0+b425",
"v0.4.0+b423",
"v0.4.0+b422",
"v0.4.0+b421",
"v0.4.0+b420",
"v0.4.0+b418",
"v0.4.0+b416",
"v0.4.0+b415",
"v0.4.0+b409",
"v0.3.6+b378",
"v0.4.0+b405",
"v0.4.0+b401",
"v0.4.0+b399",
"v0.4.0+b397",
"v0.4.0+b395",
"v0.3.7+b388",
"v0.3.7+b386",
"v0.3.6+b379",
"v0.3.6+b376",
"v0.3.6+b374",
"v0.3.6+b372",
"v0.3.6+b370",
"v0.3.6+b368",
"v0.3.6+b365",
"v0.3.6+b359+b359",
"v0.3.6+b354",
"v0.3.6+b352",
"v0.3.6+b349",
"v0.3.6+b346",
"v0.3.6+b343",
"v0.3.6+b341",
"v0.3.6+b339",
"v0.3.6+b336",
"v0.3.6+b322",
"v0.3.6+b334",
"v0.3.6+b332",
"v0.3.6+b330",
"v0.3.6+b328",
"v0.3.6+b327",
"v0.3.5+b320",
"v0.3.5+b317",
"v0.3.5+b316",
"v0.3.5+b314",
"v0.3.5+b311",
"v0.3.5+b306",
"v0.3.5+b304",
"v0.3.5+b299",
"v0.3.5+b293",
"v0.3.5+b287",
"v0.3.5+b281",
"v0.3.5+b279",
"v0.3.5+b271",
"v0.3.5+b264",
"v0.3.5+b250",
"v0.3.5+b238",
"v0.3.5+b237",
"v0.3.5+b235",
"v0.3.5+b232",
"v0.3.5+b227",
"v0.3.5+b223",
"v0.3.5+b222",
"v0.3.5+b219",
"v0.3.5+b217",
"v0.3.5+b212",
"v0.3.5+b210",
"v0.3.5+b207",
"v0.3.5+b201",
"v0.3.5+b186",
"v0.3.5+b185",
"v0.3.5+b175",
"v0.3.5+b173",
"v0.3.5+b169",
"v0.3.5+b170",
"v0.3.5+b162",
"v0.3.5+b161",
"v0.3.5+b158",
"v0.3.3+b155",
"v0.3.3+b154",
"v0.3.3+b152",
"v0.3.3+b149",
"v0.3.3+b139",
"v0.3.2+b138",
"v0.3.2+b137",
"v0.3.2+b134",
"v0.3.2+b132",
"v0.3.2+b131",
"v0.3.2+b130",
"v0.3.2+b126",
"v0.3.2+b124",
"v0.3.2+b122",
"v0.3.2+b115",
"v0.3.2+b113",
"v0.3.2+b111",
"v0.3.2+b108",
"v0.3.2+b106",
"v0.3.2+b101",
"v0.3.2+b105",
"v0.3.1+b98",
"v0.3.1+b96",
"v0.3.1+b93",
"v0.3.1+b91",
"v0.3.1+b85",
"v0.2.70",
"v0.2.64",
"v0.2.62",
"v0.2.60",
"v0.2.58",
"v0.1.45",
"v0.1.32",
"v0.1.31",
"v0.1.30",
"v0.1.29",
"v0.1.35"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77371.json"
}
}
],
"modified": "2026-10-28T02:30:23.386075762Z",
"provider": "osv",
"references": [
"https://github.com/getredash/redash/releases/tag/v26.9.0",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77371.json",
"https://github.com/getredash/redash/security/advisories/GHSA-cr68-3xxj-cg9f",
"https://nvd.nist.gov/vuln/detail/CVE-2026-77371",
"https://github.com/getredash/redash/commit/7387072af40913a64e7b3be470491792f2d5551c"
],
"provider_metadata": {
"cwe_ids": [
"CWE-284"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77371.json"
}
},
"related_cves": [
{
"value": "CVE-2026-77371",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 489818,
"published_at": "2026-10-14T18:02:07.208+00:00"
}