redash
v26.9.0Make Your Company Data Driven. Connect to any data source, easily visualize, dashboard and share your data.
- Maintenance
- Active76 commits in 3 months · bus factor 1
- License
- BSD-2-ClausePermissive · OSI-approved
- Security
- 20 advisories1 critical, 7 high, 8 medium, 4 low · Scorecard 6.0/10
- Supported versions
- No scheduleendoflife.date does not track this project
28.9k stars · 4.6k forks · 777 open issues · last release 1 month ago · data checked 1 hour ago
Security advisories
All advisories on GitHubThe 20 most recent advisories published by the maintainers: 1 critical, 7 high, 8 medium, 4 low. Check the patched version against the one you run.
- highGHSA-vf3c-8663-w8pfSep 24, 2026View-only users can execute arbitrary SQL through email addresses in query annotations
- Affected
- = 26.3.0
- Patched in
- 26.9.0
- highGHSA-gcw6-vrqh-rpfgSep 24, 2026Query API keys can read unrelated queries through the dropdown endpoint
- Affected
- <= 26.3.0
- Patched in
- 26.9.0
- highGHSA-g5q6-jghf-254rSep 24, 2026Custom JavaScript visualizations are enabled by default and run with viewer privileges
- Affected
- >= 25.1.0, <= 26.3.0
- Patched in
- 26.9.0
- highGHSA-v5m6-3vvm-h6gcSep 24, 2026View-only users can execute arbitrary SQL through text-pattern and undeclared query parameters
- Affected
- < 26.9.0
- Patched in
- 26.9.0
- lowGHSA-rpvq-m6v3-4qx3Sep 24, 2026Missing authorization on object ACL listing endpoint
- Affected
- < 26.9.0
- Patched in
- 26.9.0
- mediumGHSA-5x53-q87f-qhvqSep 24, 2026Alert update does not verify access to the target query
- Affected
- < 26.9.0
- Patched in
- 26.9.0
- mediumGHSA-c56c-w395-v939Sep 24, 2026Public dashboard tokens expose permanent query API keys
- Affected
- < 26.9.0
- Patched in
- 26.9.0
- mediumGHSA-r536-vx74-p226Sep 24, 2026Missing authorization on dashboard archive endpoint
- Affected
- < 26.9.0
- Patched in
- 26.9.0
- highGHSA-vv3x-p6f3-rh5mSep 24, 2026Dashboard fork bypasses data source access controls
- Affected
- >= 24.04.0, < 26.9.0
- Patched in
- 26.9.0
- lowCVE-2026-76083Sep 24, 2026JSON data source query URL can bypass base URL restriction
- Affected
- >= 10.0.0, < 26.9.0
- Patched in
- 26.9.0
- lowGHSA-8fm9-9p2c-9f37Sep 24, 2026Query Results data source bypasses data source access controls on cached results
- Affected
- < 26.9.0
- Patched in
- 26.9.0
- mediumCVE-2026-77371Sep 24, 2026DuckDB query runner allows arbitrary file read/write via unrestricted external access
- Affected
- >= 26.0.0, < 26.9.0
- Patched in
- 26.9.0
- highCVE-2026-42093Sep 24, 2026SQL Injection via Query Results parameterized query substitution
- Affected
- > 8.0.0, < 26.9.0
- Patched in
- 26.9.0
- mediumCVE-2026-33213Jul 9, 2026Open redirect vulnerability in post-login redirect handling
- Affected
- >= 5.0.2, <= 26.3.0
- Patched in
- 26.9.0
- mediumCVE-2020-36144May 18, 2024LDAP injection in auth_ldap_user
- Affected
- >3
- criticalCVE-2021-21239Apr 3, 2023SAML Privilege Escalation via PySAML2
- Affected
- <=11
- Patched in
- >11
- mediumCVE-2021-43780Nov 23, 2021Server-Side Request Forgery (SSRF) in Redash
- Affected
- <= 10.0
- Patched in
- 10.1
- highCVE-2021-41192Nov 23, 2021Insecure default configuration
- Affected
- <=10.0
- Patched in
- 10.1
- mediumCVE-2021-43777Nov 23, 2021Insecure use of state parameter for Google OAuth Login
- Affected
- <=10.0
- Patched in
- 10.1
- lowCVE-2020-12725Jun 15, 2020Authenticated Server-Side Request Forgery (SSRF) in the JSON data source / internal addresses restriction bypass
- Affected
- >=v8.0.0-beta
- Patched in
- v9.0.0-beta