CVE-2026-33213: falha de média gravidade em getredash redash
Redash: Open redirect vulnerability in post-login redirect handling
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 6.1epss 0.3%
Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the get_next_path() function in Redash's authentication module stripped the scheme and netloc from user-supplied next parameters but did not normalize multiple leading slashes, allowing a crafted login URL such as /login?next=////evil.com to redirect users to an external attacker-controlled site after authentication.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
getredash · redashCVEs relacionadas — getredash redash
No mesmo produto, das mais perigosas para as menos.
CVE-2021-41192HIGHInsecure default configurationEPSS 8.1%CVE-2021-43780MEDIUMServer-Side Request Forgery (SSRF) in RedashEPSS 1.0%CVE-2026-42093HIGHRedash: SQL Injection via Query Results parameterized query substitutionEPSS 0.7%CVE-2026-77371CRITICALRedash: DuckDB query runner allows arbitrary file read/write via unrestricted external accessEPSS 0.5%CVE-2026-76083MEDIUMRedash: JSON data source query URL can bypass base URL restrictionEPSS 0.4%CVE-2021-43777MEDIUMVulnerability in Redash OAuth2 flows due to misuse of state field (should be a nonce)EPSS 0.3%