{"schema":"threatline.record/2","record":{"id":"CVE-2026-77371","aliases":["GHSA-cr68-3xxj-cg9f"],"summary":"Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access","details":"Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.","categories":["Unclassified"],"product":"redash","vendor":"getredash","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-77371","source_modified_at":"2026-10-14T19:36:16.578Z","fetched_at":"2026-10-23T18:48:36.087640Z","product":"redash","vendor":"getredash","versions":[{"version":">= 26.0.0, < 26.9.0","status":"affected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":9.3,"severity":"Critical","kev":{"listed":false},"epss":{"probability":0.00525,"percentile":0.43693,"score_date":"2026-10-23"},"published_at":"2026-10-14T18:02:07.208Z","modified_at":"2026-10-14T19:36:16.578Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-77371","fetched_at":"2026-10-23T18:48:36.087640Z","source_modified_at":"2026-10-14T19:36:16.578Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-77371","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/getredash/redash/security/advisories/GHSA-cr68-3xxj-cg9f","tags":["exploit"]},{"source":"CVE List","url":"https://github.com/getredash/redash/commit/7387072af40913a64e7b3be470491792f2d5551c","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/getredash/redash/releases/tag/v26.9.0","tags":["x_refsource_MISC"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"poc","automatable":"no","technical_impact":"total","assessed_at":"2026-10-14T19:35:55.829497Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-14T19:36:16.578Z","content_hash":"7fc7c1c937065cd94d70bc35dde93366971c1c8e27b7485d71970534b8c3be96"}}