Is CVE-2026-76083 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-76083 being exploited in the wild.

How severe is CVE-2026-76083?

Informational severity, published 14 October 2026.

Is there a fix for CVE-2026-76083?

Yes: fixed in 26.9.0. Until then: Restrict execute_query permissions on JSON data sources to trusted users, or disable JSON data sources if they are not in active use. [{"kind":"disclosed","at":"2026-10-14","note":"CVE-2026-76083 published"},{"kind":"patched","at":"2026-09-24","note":"Fixed in Redash v26.9.0"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-76083 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-76083?

Check whether you run Redash at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-76083: Redash JSON data source URL validation bypass

CVE-2026-76083 · Severity: info · Published 2026-10-14

Redash is a data visualization and analytics platform. A flaw in its JSON data source query runner allowed users with query execution permissions to bypass the configured base URL restriction and send server-side requests to arbitrary external hosts. If HTTP Basic Authentication credentials were configured for that data source, those credentials would be forwarded to the attacker-controlled destination, potentially exposing sensitive authentication material.

Technologies: Redash. Vendors: Redash.

Quick answers

Is CVE-2026-76083 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-76083 being exploited in the wild.
How severe is CVE-2026-76083?: Informational severity, published 14 October 2026.
Which products and versions are affected?: Redash 10.0.0 to 26.8.x.
Is there a fix for CVE-2026-76083?: Yes: fixed in 26.9.0. Until then: Restrict execute_query permissions on JSON data sources to trusted users, or disable JSON data sources if they are not in active use.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-14","note":"CVE-2026-76083 published"},{"kind":"patched","at":"2026-09-24","note":"Fixed in Redash v26.9.0"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-76083 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-76083?: Check whether you run Redash at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 26.9.0

Restrict execute_query permissions on JSON data sources to trusted users, or disable JSON data sources if they are not in active use.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-14","note":"CVE-2026-76083 published"},{"kind":"patched","at":"2026-09-24","note":"Fixed in Redash v26.9.0"}]

Technical details

The JSON query runner used urljoin(base_url, url) to combine the configured base URL with a user-supplied query URL, but Python's urljoin treats absolute URLs in the second argument as complete replacements, bypassing the base URL entirely. A user with execute_query permission could supply an absolute URL to redirect the server-side HTTP request to an arbitrary origin, and if HTTP Basic Auth was configured on the data source, those credentials would be sent to that origin. The fix adds hostname validation after URL resolution to ensure the final URL's host matches the configured base URL's host.

Affected products

Redash Redash 10.0.0 to 26.8.x

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.