CVE-2026-76083

MediumCVSS 4.9/10Last modified Oct 16, 2026

Description

Redash is a package for data visualization and sharing. From 10.0.0 until 26.9.0, the JSON data source query runner in redash/query_runner/json_ds.py used _get_all_results() to combine its configured base_url with a user-supplied query URL by using urljoin. An absolute query URL replaced the configured base URL instead of remaining under it, allowing a user with execute_query permission to direct a server-side request to an arbitrary external origin. When HTTP Basic Auth was configured for the data source, the request also forwarded those credentials to the selected origin. Private and internal address access remained constrained when REDASH_ENFORCE_PRIVATE_IP_BLOCK was enabled. This issue is fixed in version 26.9.0.

Metrics

CVSS 4.0 4.9/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-918

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 14, 2026
Last modified: Oct 16, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-760868.5Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action CVE-2026-760878.2Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in Submissi CVE-2026-760897.7Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content con CVE-2026-76098.8A flaw has been found in TRENDnet TEW-821DAP up to 1.12B01. The impacted element is the function tools_diagnostic of the file /tmp/diagnosti CVE-2026-760987.5Mistune is a Python Markdown parser with renderers and plugins. Versions 3.3.0 through 3.3.2 are vulnerable to DoS through deeply nested tok CVE-2026-76108.1A vulnerability has been found in TRENDnet TEW-821DAP 1.12B01. This affects an unknown function of the file /www/cgi/ssi of the component Fi CVE-2026-761045.5Dell ObjectScale, versions prior to 4.4.0.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability in the OS. A hi CVE-2026-761057.1Dell Container Storage Modules, versions prior to 1.18.0 contain(s) an Use of Insufficiently Random Values vulnerability. An unauthenticated CVE-2026-76118.1A vulnerability was found in TRENDnet TEW-821DAP up to 1.12B01. This impacts the function platform_do_upgrade_cameo_dev of the file cameo_de CVE-2026-761118.8Dell PowerStore contains an Incorrect Authorization vulnerability. An authenticated attacker with low privileges could potentially exploit t CVE-2026-761134.3Dell Terraform Provider for Redfish, versions 1.1.0 through 1.6.1, contains an Exposure of Sensitive Information to an Unauthorized Actor vu CVE-2026-761145.9Dell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a Cleartext Transmission of Sensitive Information v