CVE-2026-76083 getredash CVE debrief

Who should care

Redash users and administrators should assess exposure and verify their version of Redash. Users with execute_query permission should be aware of the potential for server-side request forgery and take steps to mitigate it. Affected operators, platforms, and security teams need to review and update their systems to prevent exploitation. Vulnerability management and security teams should prioritize verification and remediation efforts.

Why it matters

CVE-2026-76083 allows users with execute_query permission to direct server-side requests to arbitrary external origins in Redash versions 10.0.0 to 26.9.0. This issue has a medium CVSS score of 4.9 and requires verification and potential updates for affected Redash users.

• Potential for server-side request forgery
• Possible exposure to external origins
• Risk of credential forwarding with HTTP Basic Auth
• Verification of Redash version and user permissions required

Technical summary

The JSON data source query runner in Redash versions 10.0.0 to 26.9.0 used _get_all_results() to combine its configured base_url with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured base URL instead of remaining under it, allowing a user with execute_query permission to direct a server-side request to an arbitrary external origin. This issue enables server-side request forgery and potential exposure to external origins. HTTP Basic Auth credentials are forwarded to the selected origin.

Defensive priority

Medium priority for Redash users to verify and update

Recommended defensive actions

• Verify Redash version and check for updates to 26.9.0 or later
• Review user permissions and restrict execute_query access
• Monitor server-side requests for suspicious activity
• Implement compensating controls for exposed systems
• Conduct asset inventory to identify potentially affected systems
• Track exceptions and retest remediated assets
• Review source tracking for vulnerability management

Evidence notes

The CVE record and source item provide details on the vulnerability in Redash versions 10.0.0 to 26.9.0. The issue allows users with execute_query permission to direct server-side requests to arbitrary external origins. Verification and potential updates are required for affected Redash users. The vulnerability has a medium CVSS score of 4.9 and requires review of user permissions and server-side request monitoring.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.