PT-2026-114285 · Getredash+1 · Redash
CVE-2026-77371
·
Publicado
2026-10-14
·
Atualizado
2026-10-14
CVSS v4.0
9.3
Crítica
| Vetor | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect() path in redash/query runner/duckdb.py created connections with enable external access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH COOKIE SECRET or REDASH SECRET KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.
Exploit
Correção
Improper Access Control
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Redash