CVE-2026-33213: Redash: Open redirect vulnerability in post-login redirect handling
Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the getnextpath() function in Redash's authentication module stripped the scheme and netloc from user-supplied next parameters but did not normalize multiple leading slashes, allowing a crafted login URL such as /login?next=////evil.com to redirect users to an external attacker-controlled site after authentication.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-33213?
CVE-2026-33213 has a medium severity rating of 6.1.
What type of vulnerability is CVE-2026-33213?
CVE-2026-33213 is an open redirect vulnerability in the post-login redirect handling of Redash.
How can I mitigate CVE-2026-33213?
To mitigate CVE-2026-33213, update Redash to a version that contains the fix, starting from version 26.3.1 or later.
Which versions of Redash are affected by CVE-2026-33213?
CVE-2026-33213 affects Redash versions from 5.0.2 to 26.3.0.
What impact does CVE-2026-33213 have on my Redash instance?
CVE-2026-33213 can potentially allow an attacker to redirect users to malicious sites after logging in.