CVE-2026-76083: Redash: JSON data source query URL can bypass base URL restriction
Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/queryrunner/jsonds.py used getallresults() to combine its configured baseurl with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured base URL instead of remaining under it, allowing a user with executequery permission to direct a server-side request to an arbitrary external origin. When HTTP Basic Auth was configured for the data source, the request also forwarded those credentials to the selected origin. Private and internal address access remained constrained when REDASHENFORCEPRIVATEIPBLOCK was enabled. This issue is fixed in version 26.9.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Redashto a version that resolves this vulnerability.Fixed in 26.9.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A user needs execute_query permission for an affected JSON data source. They can supply an absolute query URL that causes the Redash server to send a request to an arbitrary external origin.
What is the impact when the JSON data source uses HTTP Basic Auth?
The server forwards the configured HTTP Basic Auth credentials with the request to the attacker-selected origin. This can expose those credentials to that external service.
Are internal or private network targets reachable through this issue?
Private and internal address access remains constrained when REDASH_ENFORCE_PRIVATE_IP_BLOCK is enabled. The provided information does not establish the behavior when that setting is not enabled.
What remediation is available?
Upgrade Redash to version 26.9.0, which fixes the issue. Affected versions are stated as 10.0.0 through before 26.9.0.