Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-76083— Redash: JSON data source query URL can bypass base URL restriction

Quick assessment

Affected
getredash redash
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/query_runner/json_ds.py used _get_all_results() to combine its configured base_url with a user-supplied query URL by using urljoin. An

CVSS 4.9 · Medium

Affected Version Matrix 1

VendorProduct Version RangeStatus
getredash redash >= 10.0.0, < 26.9.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-76083

Vulnerability Information

Shenlong is analyzing...

Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Redash: JSON data source query URL can bypass base URL restriction
Source: CVE Program / CVE List V5
Vulnerability Description
Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/query_runner/json_ds.py used _get_all_results() to combine its configured base_url with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured base URL instead of remaining under it, allowing a user with execute_query permission to direct a server-side request to an arbitrary external origin. When HTTP Basic Auth was configured for the data source, the request also forwarded those credentials to the selected origin. Private and internal address access remained constrained when REDASH_ENFORCE_PRIVATE_IP_BLOCK was enabled. This issue is fixed in version 26.9.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
getredash redash >= 10.0.0, < 26.9.0 -

II. Public POCs for CVE-2026-76083

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-76083

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-76083 (1)

Other References for CVE-2026-76083 (2)

Same Patch Batch · getredash · 2026-10-14 · 3 CVEs total

CVE-2026-77371 9.3 CRITICAL Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external acc
CVE-2026-42093 8.7 HIGH Redash: SQL Injection via Query Results parameterized query substitution

IV. Related Vulnerabilities

Same product: redash
Same vendor: getredash
Same weakness: CWE-918

V. Comments for CVE-2026-76083

No comments yet

Leave a comment