Redash flaw lets users read secrets and write files via DuckDB

A critical security flaw in the Redash data visualization platform allows users with query access to read sensitive files and write new ones to the server. The issue stems from how the DuckDB query runner handles external access settings. According to the National Vulnerability Database, this vulnerability is rated critical with a CVSS score of 9.3. Organizations using affected versions face immediate risk of credential theft and system compromise.

The risk

The vulnerability exists in the DuckDB query runner component of Redash. From version 26.0.0 until 26.9.0, the _connect() path in the duckdb.py file created database connections with enable_external_access left at its default true value. This configuration allows a user with query access to an administrator-created DuckDB data source to execute native file-reading functions. They can retrieve any file readable by the Redash process.

Attackers can also use the COPY TO command to write files with the privileges of the Redash process. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could enable forged sessions. This effectively allows for authentication bypass. The National Vulnerability Database describes the weakness as CWE-284.

Who is exposed

Any organization running Redash versions 26.0.0 through 26.9.0 is exposed to this threat. The National Vulnerability Database identifies the affected package as getredash redash. The issue affects all installations within this version range that use the DuckDB query runner. Administrators who have created DuckDB data sources expose their environments to this specific attack vector. A user must have query access to an administrator-created DuckDB data source to exploit the flaw.

Cost and compliance

The National Vulnerability Database classifies the weakness under CWE-284, which relates to improper access control. This classification highlights the failure to restrict file operations to authorized processes only. The critical severity rating indicates a high impact potential. Organizations must consider the potential impact on data integrity and confidentiality. The source material does not specify compliance framework violations.

What happens next

The Redash development team has released a fix for this issue. Version 26.9.0 addresses the vulnerability by correcting the default behavior of the DuckDB query runner. Administrators should verify their current installation version immediately. If running an affected version, upgrading to 26.9.0 or later is the confirmed remediation. This update removes the ability for users to leverage the external access flag for unauthorized file operations.

Questions to ask your suppliers

Ask your software vendors whether they monitor for default configurations that allow external access. Request details on how they validate security settings during deployment. Determine if they provide automated alerts for critical vulnerabilities in data tools. Check whether their support team can assist with emergency patching. Ensure your internal IT leadership knows about the risk. Notify your security operations center to watch for unusual file access patterns. Confirm that your incident response plan covers data exfiltration via query interfaces.

Background: National Vulnerability Database

The National Vulnerability Database is a centralized repository that standardizes information about software weaknesses. It assigns unique identifiers to each flaw, allowing security tools to automatically detect and assess risks in your systems without manual research.

Read the full guide: National Vulnerability Database Explained: How NVD Works for You

What to do and how to stay safe: Redash

• Verify the version of Redash installed on your servers and compare it against the affected range.
• Upgrade to version 26.9.0 or later once the vendor provides the update to close the flaw.
• Audit DuckDB data sources to ensure external access is disabled where not strictly required.
• Monitor server logs for unauthorized file creation or access attempts by query users.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of Redash are affected by this vulnerability?

Redash versions 26.0.0 through 26.9.0 are affected by this critical security flaw.

What can an attacker do with this vulnerability?

An attacker can read files accessible to the Redash process and write files with its privileges.

Is there a fix for this issue?

Yes, the issue is fixed in Redash version 26.9.0.