Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-76083— Redash: JSON data source query URL can bypass base URL restriction

Quick assessment

Affected
getredash redash
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Redash 是一个用于数据可视化和共享的软件包。在版本 10.0.0 至 26.9.0 之间，Redash 的 JSON 数据源查询运行器（位于 ）在使用 函数将配置的基础 URL（base_url）与用户提供的查询 URL 拼接时，存在逻辑缺陷。具体而言，当用户提供的查询 URL 为绝对路径时，它会直接替换所配置的基础 URL，而非作为其子路径存在。这一漏洞使得拥有 权限的用户能够引导服务器发起指向任意外部域名的请求。若该数据源配置了 HTTP 基本认证（HTTP Basic Auth），则认证凭据也会被一并转

CVSS 4.9 · Medium EPSS 0.41% · P34

Affected Version Matrix 1

VendorProduct Version RangeStatus
getredash redash >= 10.0.0, < 26.9.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-76083

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Redash: JSON data source query URL can bypass base URL restriction
Source: CVE Program / CVE List V5
Vulnerability Description
Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/query_runner/json_ds.py used _get_all_results() to combine its configured base_url with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured base URL instead of remaining under it, allowing a user with execute_query permission to direct a server-side request to an arbitrary external origin. When HTTP Basic Auth was configured for the data source, the request also forwarded those credentials to the selected origin. Private and internal address access remained constrained when REDASH_ENFORCE_PRIVATE_IP_BLOCK was enabled. This issue is fixed in version 26.9.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
服务端请求伪造(SSRF)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
getredash redash >= 10.0.0, < 26.9.0 -

II. Public POCs for CVE-2026-76083

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-76083

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-76083 (1)

Other References for CVE-2026-76083 (2)

Same Patch Batch · getredash · 2026-10-14 · 3 CVEs total

CVE-2026-77371 9.3 CRITICAL Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external acc
CVE-2026-42093 8.7 HIGH Redash: SQL Injection via Query Results parameterized query substitution

IV. Related Vulnerabilities

Same product: redash
Same vendor: getredash
Same weakness: CWE-918

V. Comments for CVE-2026-76083

No comments yet

Leave a comment