{"id":"CVE-2026-77371","summary":"Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access","details":"Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.","aliases":["GHSA-cr68-3xxj-cg9f"],"modified":"2026-10-15T10:31:05.597861950Z","published":"2026-10-14T18:02:07.208Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-284"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77371.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77371.json"},{"type":"FIX","url":"https://github.com/getredash/redash/commit/7387072af40913a64e7b3be470491792f2d5551c"},{"type":"WEB","url":"https://github.com/getredash/redash/releases/tag/v26.9.0"},{"type":"ADVISORY","url":"https://github.com/getredash/redash/security/advisories/GHSA-cr68-3xxj-cg9f"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-77371"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/getredash/redash","events":[{"introduced":"0"},{"fixed":"42fdf9d4a0fdb83841130ab78f69899a224f281b"}],"database_specific":{"extracted_events":[{"introduced":"26.0.0"},{"fixed":"26.9.0"}],"source":"AFFECTED_FIELD"}}],"versions":["26.09.0-dev","26.08.0-dev","26.07.1-dev","26.07.0-dev","26.06.0-dev","26.05.0-dev","26.04.0-dev","26.03.0-dev","26.02.0-dev","26.01.0-dev","25.12.0-dev","25.11.0-dev","25.10.0-dev","25.09.0-dev","25.08.0-dev","25.07.0-dev","25.06.0-dev","25.05.0-dev","25.04.0-dev","25.03.0-dev","25.02.0-dev","25.01.0-dev","24.12.0-dev","24.11.0-dev","24.10.0-dev","24.09.0-dev","24.08.1-dev","24.08.0-dev","24.07.0-dev","24.06.0-dev","24.05.0-dev","24.04.0-dev","24.03.0-dev","23.12.0-dev","23.11.0-dev","23.10.0-dev","23.09.0-dev","v6.0.0-beta","v5.0.0","v4.0.1","v5.0.0-beta","v4.0.0","v4.0.0-rc.1","v4.0.0-beta","v3.0.0","v2.0.0","v1.0.3","v1.0.1","v1.0.2","v1.0.0-rc.2","v1.0.0-rc.1","v0.12.0.b2449","v0.11.0.b2016","v0.10.0.b1774","v0.11.0-rc","v0.9.2.b1536","v0.9.2-rc","v0.9.1.b1377","v0.9.1-rc","v0.9.0.b1363","v0.9.0-rc","v0.8.3.b1192","v0.8.3-rc","v0.8.2.b1181","v0.8.2-rc","v0.8.1.b1110","v0.8.1-rc","v0.8.0.b1058","v0.8.0-rc","v0.7.1.b1015","v0.7.1-rc","0.7.0","v0.7.0-rc","v0.6.4-rc","v0.6.3.b906","v0.6.2.b887","v0.6.2-rc","v0.6.3-rc","v0.6.1.b885","v0.6.1-rc","v0.6.0.b812","v0.6.0+b767","v0.6.0+b762","v0.6.0+b760","v0.6.0+b759","v0.6.0+b748","v0.6.0+b746","v0.6.0+b737","v0.6.0+b735","v0.6.0+b733","v0.6.0+b731","v0.6.0+b729","v0.6.0+b727","v0.6.0+b723","v0.6.0+b722","v0.6.0+b720","v0.6.0+b718","v0.6.0+b716","v0.6.0+b714","v0.6.0+b711","v0.6.0+b710","v0.6.0+b709","v0.6.0+b707","v0.6.0+b705","v0.6.0+b703","v0.5.0+b696","v0.5.0+b690","v0.5.0+b689","v0.5.0+b685","v0.5.0+b683","v0.5.0+b681","v0.5.0+b680","v0.5.0+b679","v0.5.0+b678","v0.5.0+b676","v0.5.0+b674","v0.5.0+b670","v0.5.0+b666","v0.5.0+b664","v0.5.0+b661","v0.5.0+b656","v0.5.0+b655","v0.5.0+b654","v0.5.0+b652","v0.5.0+b650","v0.5.0+b648","v0.4.0+b641","v0.4.0+b636","v0.4.0+b640","v0.4.0+b634","v0.4.0+b632","v0.4.0+b630","v0.4.0+b623","v0.4.0+b629","v0.4.0+b628","v0.4.0+b627","v0.4.0+b622","v0.4.0+b620","v0.4.0+b618","v0.4.0+b614","v0.4.0+b608","v0.4.0+b606","v0.4.0+b604","v0.4.0+b602","v0.4.0+b595","v0.4.0+b591","v0.4.0+b589","v0.4.0+b588","v0.4.0+b587","v0.4.0+b585","v0.4.0+b573","v0.4.0+b582","v0.4.0+b568","v0.4.0+b567","v0.4.0+b581","v0.4.0+b564","v0.4.0+b563","v0.4.0+b549","v0.4.0+b562","v0.4.0+b560","v0.4.0+b559","v0.4.0+b556","v0.4.0+b555","v0.4.0+b554","v0.4.0+b552","v0.4.0+b546","v0.4.0+b544","v0.4.0+b542","v0.4.0+b538","v0.4.0+b537","v0.4.0+b536","v0.4.0+b534","v0.4.0+b532","v0.4.0+b531","v0.4.0+b528","v0.4.0+b525","v0.4.0+b522","v0.4.0+b521","v0.4.0+b518","v0.4.0+b514","v0.4.0+b513","v0.4.0+b510","v0.4.0+b508","v0.4.0+b489","v0.4.0+b507","v0.4.0+b500","v0.4.0+b498","v0.4.0+b493","v0.4.0+b491","v0.4.0+b484","v0.4.0+b480","v0.4.0+b453","v0.4.0+b449","v0.4.0+b447","v0.4.0+b445","v0.4.0+b444","v0.4.0+b442","v0.4.0+b440","v0.4.0+b438","v0.4.0+b437","v0.4.0+b436","v0.4.0+b435","v0.4.0+b433","v0.4.0+b431","v0.4.0+b429","v0.4.0+b427","v0.4.0+b424","v0.4.0+b426","v0.4.0+b425","v0.4.0+b423","v0.4.0+b422","v0.4.0+b421","v0.4.0+b420","v0.4.0+b418","v0.4.0+b416","v0.4.0+b415","v0.4.0+b409","v0.3.6+b378","v0.4.0+b405","v0.4.0+b401","v0.4.0+b399","v0.4.0+b397","v0.4.0+b395","v0.3.7+b388","v0.3.7+b386","v0.3.6+b379","v0.3.6+b376","v0.3.6+b374","v0.3.6+b372","v0.3.6+b370","v0.3.6+b368","v0.3.6+b365","v0.3.6+b359+b359","v0.3.6+b354","v0.3.6+b352","v0.3.6+b349","v0.3.6+b346","v0.3.6+b343","v0.3.6+b341","v0.3.6+b339","v0.3.6+b336","v0.3.6+b322","v0.3.6+b334","v0.3.6+b332","v0.3.6+b330","v0.3.6+b328","v0.3.6+b327","v0.3.5+b320","v0.3.5+b317","v0.3.5+b316","v0.3.5+b314","v0.3.5+b311","v0.3.5+b306","v0.3.5+b304","v0.3.5+b299","v0.3.5+b293","v0.3.5+b287","v0.3.5+b281","v0.3.5+b279","v0.3.5+b271","v0.3.5+b264","v0.3.5+b250","v0.3.5+b238","v0.3.5+b237","v0.3.5+b235","v0.3.5+b232","v0.3.5+b227","v0.3.5+b223","v0.3.5+b222","v0.3.5+b219","v0.3.5+b217","v0.3.5+b212","v0.3.5+b210","v0.3.5+b207","v0.3.5+b201","v0.3.5+b186","v0.3.5+b185","v0.3.5+b175","v0.3.5+b173","v0.3.5+b169","v0.3.5+b170","v0.3.5+b162","v0.3.5+b161","v0.3.5+b158","v0.3.3+b155","v0.3.3+b154","v0.3.3+b152","v0.3.3+b149","v0.3.3+b139","v0.3.2+b138","v0.3.2+b137","v0.3.2+b134","v0.3.2+b132","v0.3.2+b131","v0.3.2+b130","v0.3.2+b126","v0.3.2+b124","v0.3.2+b122","v0.3.2+b115","v0.3.2+b113","v0.3.2+b111","v0.3.2+b108","v0.3.2+b106","v0.3.2+b101","v0.3.2+b105","v0.3.1+b98","v0.3.1+b96","v0.3.1+b93","v0.3.1+b91","v0.3.1+b85","v0.2.70","v0.2.64","v0.2.62","v0.2.60","v0.2.58","v0.1.45","v0.1.32","v0.1.31","v0.1.30","v0.1.29","v0.1.35"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77371.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:N"}]}