CVE-2026-77371: Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access
Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's connect() path in redash/queryrunner/duckdb.py created connections with enableexternalaccess left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASHCOOKIESECRET or REDASHSECRETKEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redashto a version that resolves this vulnerability.Fixed in 26.9.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A user who has query access to a DuckDB data source created by an administrator can exploit it. The user does not need administrator privileges, but must be able to run queries against that data source.
Which deployments are affected by the default configuration?
Redash versions from 26.0.0 up to, but not including, 26.9.0 are affected when using an administrator-created DuckDB data source. The vulnerable connection path leaves DuckDB external access enabled by default.
What could an attacker access or change?
An attacker can use DuckDB native file-reading functions to read files accessible to the Redash process and COPY TO to write files with that process's privileges. If application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY are readable, they may be used to forge sessions and bypass authentication.
What should be done if an immediate upgrade is not possible?
Restrict query access to administrator-created DuckDB data sources to trusted users, because query-capable users are the exploitation boundary described for this issue. Upgrade to Redash 26.9.0 when possible.