redash vulnerabilities

2 known vulnerabilities in redash from Getredash. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.3 Critical severity

  redash: Improper Access Control

  CVE-2026-77371Oct 14, 2026Getredash

  Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query ac

• 8.7 High severity

  redash: Improper Neutralization of Special Elements used in an SQL Command

  CVE-2026-42093Oct 14, 2026Getredash

  Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-controlled values to replace