CVE-2026-33213

Awaiting Analysis Awaiting Analysis - Queue

Authentication Bypass via Path Traversal in Redash

Publication date: 2026-07-15

Last updated on: 2026-07-15

Assigner: GitHub, Inc.

Description

Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the get_next_path() function in Redash's authentication module stripped the scheme and netloc from user-supplied next parameters but did not normalize multiple leading slashes, allowing a crafted login URL such as /login?next=////evil.com to redirect users to an external attacker-controlled site after authentication.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-15

Last Modified

2026-07-15

Generated

2026-08-04

AI Q&A

2026-07-16

EPSS Evaluated

2026-08-03

NVD

CVE-2026-33213

EUVD

EUVD-2026-44686

Affected Vendors & Products

Vendor	Product	Version / Range
getredash	redash	to 26.3.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-601	The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Attack-Flow Graph

Executive Summary

CVE-2026-33213 is an open redirect vulnerability in Redash, a data visualization tool. It occurs in the get_next_path() function of the authentication module. The issue allows attackers to craft malicious login URLs with multiple leading slashes (e.g., /////evil.com) that bypass sanitization. Browsers interpret these as protocol-relative URLs, redirecting users to attacker-controlled sites after authentication.

Detection Guidance

To detect this vulnerability, inspect Redash authentication logs for unusual redirect URLs containing multiple leading slashes (e.g., /login?next=////evil.com). Check if users are redirected to external domains after authentication. Manually test by crafting URLs with excessive slashes in the 'next' parameter to see if they bypass validation.

Impact Analysis

This vulnerability can lead to phishing attacks or credential theft. Users may trust the legitimate Redash login page but be redirected to a malicious site after entering credentials. It affects all authentication methods including password login, Google OAuth, LDAP, and remote user authentication.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling phishing attacks that trick users into revealing credentials or sensitive data. If attackers redirect users to malicious sites, it may lead to unauthorized access to personal or health information, violating data protection requirements. However, the vulnerability itself does not directly expose stored data but facilitates social engineering attacks that could compromise compliance.

Mitigation Strategies

Upgrade Redash to version 26.3.1 or later. If upgrading is not possible, apply a manual patch to the get_next_path() function in redash/authentication/__init__.py to normalize multiple leading slashes. Ensure all authentication methods (password, OAuth, LDAP) are covered by the fix.

Hi! I’m here to help you understand CVE-2026-33213. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70