CVE-2026-77371

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect() path in redash/query runner/duckdb.py created connections with enable external access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH COOKIE SECRET or REDASH SECRET KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.