CVE-2026-77371

Awaiting Analysis Awaiting Analysis - Queue

DuckDB Query Runner File Read/Write in Redash

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-77371

EUVD

EUVD-2026-101518

Affected Vendors & Products

Vendor	Product	Version / Range
getredash	redash	>= 26.0.0, < 26.9.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects Redash versions 26.0.0 to 26.8.x. The DuckDB query runner allowed external access by default, enabling users with query access to read or write files on the system using DuckDB functions like read_text() or COPY TO. This could expose sensitive files such as application secrets, leading to authentication bypass.

Detection Guidance

Check Redash versions between 26.0.0 and 26.9.0. Inspect DuckDB data source configurations for enable_external_access set to true. Review query logs for suspicious file read/write operations using DuckDB functions like read_text(), read_csv(), or COPY TO commands.

Impact Analysis

An attacker with access to a DuckDB data source could read sensitive files like environment variables containing secrets or write arbitrary files on the system. This may lead to data breaches, session hijacking, or further system compromise depending on the exposed data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's requirements for safeguarding protected health information. Organizations using affected versions may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade Redash to version 26.9.0 or later. Disable DuckDB data sources or restrict access to trusted users only. Set enable_external_access to false in DuckDB configurations. Block local filesystem access by ensuring disabled_filesystems='LocalFileSystem'.

Hi! I’m here to help you understand CVE-2026-77371. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70