Is CVE-2026-77371 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-77371 being exploited in the wild.

How severe is CVE-2026-77371?

Informational severity, published 14 October 2026.

How is CVE-2026-77371 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-77371?

Check whether you run Redash at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-77371: Redash DuckDB unrestricted file access and privilege escalation

CVE-2026-77371 · Severity: info · Published 2026-10-14

Redash is a data visualization and analytics tool that allows users to build queries and dashboards. Versions 26.0.0 through 26.8.x had a critical security flaw in the DuckDB query runner that allowed users with query access to read arbitrary files from the server or write files using the Redash application's privileges. An attacker could steal sensitive secrets used for session authentication, enabling complete account takeover and authentication bypass.

Technologies: Redash. Vendors: Redash.

Quick answers

Is CVE-2026-77371 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-77371 being exploited in the wild.
How severe is CVE-2026-77371?: Informational severity, published 14 October 2026.
Which products and versions are affected?: Redash 26.0.0 to 26.8.x.
Is there a fix for CVE-2026-77371?: Yes: fixed in 26.9.0. Until then: Disable DuckDB data sources or restrict query access to trusted users until upgrading. Administrators should audit DuckDB query history for suspicious read_text, read_csv, or COPY TO operations. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-77371 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-77371?: Check whether you run Redash at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 26.9.0

Disable DuckDB data sources or restrict query access to trusted users until upgrading. Administrators should audit DuckDB query history for suspicious read_text, read_csv, or COPY TO operations.

Technical details

The DuckDB query runner created connections with enable_external_access set to true by default, allowing native file-reading functions (read_text, read_csv) and COPY TO operations to access the local filesystem. A user with data source access could exploit this to read files readable by the Redash process, including environment variables or configuration files containing REDASH_COOKIE_SECRET or REDASH_SECRET_KEY. The fix in 26.9.0 disables local filesystem access via disabled_filesystems='LocalFileSystem' and locks configuration to prevent user override.

Affected products

Redash Redash 26.0.0 to 26.8.x

Timeline

2026-10-14: disclosed
2026-09-24: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.