CVE-2026-76083

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-76083

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76083.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-76083

Aliases

GHSA-m723-r867-wfgw

Published

2026-10-14T18:01:19Z

Modified

2026-10-15T02:47:44Z

Severity

4.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N CVSS Calculator

Summary

Redash: JSON data source query URL can bypass base URL restriction

Details

Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/query_runner/json_ds.py used _get_all_results() to combine its configured base_url with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured base URL instead of remaining under it, allowing a user with execute_query permission to direct a server-side request to an arbitrary external origin. When HTTP Basic Auth was configured for the data source, the request also forwarded those credentials to the selected origin. Private and internal address access remained constrained when REDASH_ENFORCE_PRIVATE_IP_BLOCK was enabled. This issue is fixed in version 26.9.0.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-918"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/76xxx/CVE-2026-76083.json"
}

References

Affected packages

Git / github.com/getredash/redash

Affected ranges

Type

GIT

Repo

https://github.com/getredash/redash

Events

Introduced

9c928bd1d3f00c994f37e1a87edaddd646259f56

Fixed

42fdf9d4a0fdb83841130ab78f69899a224f281b

Database specific

Show details

{
    "extracted_events":  [
        {
            "introduced":  "10.0.0"
        },
        {
            "fixed":  "26.9.0"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-76083.json"