Redash CVE-2026-76083

Requires an authenticated Redash user holding execute_query permission on a JSON data source (per PR:L), running versions 10.0.0 up to but not including 26.9.0. The high-value outcome - credential theft - requires that the JSON data source be configured with HTTP Basic Auth (username/password), which are then forwarded to the attacker-chosen origin. SSRF to internal or private addresses additionally requires that REDASH_ENFORCE_PRIVATE_IP_BLOCK be left disabled; when that flag is enabled, private/internal access is blocked and exploitation is limited to arbitrary external origins. Limiting factors: no anonymous/unauthenticated path (valid account with query execution rights needed), no impact unless a JSON data source exists, and credential exposure is contingent on Basic Auth being configured on that source.

This is a genuine but moderate-severity SSRF (CWE-918), not a drop-everything emergency. The authoritative CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N, base 4.9) is internally consistent with the description: network-reachable, low complexity, but requiring a present attack condition (AT:P) and low privileges (PR:L) - specifically a user who already holds execute_query permission. The high subsequent-system confidentiality impact (SC:H) reflects the real danger: when the JSON data source is configured with HTTP Basic Auth, the server forwards those credentials to an attacker-chosen origin, so the primary loss is credential disclosure to a downstream system rather than compromise of Redash itself (VC:L). No EPSS score, KEV listing, or public exploit was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation - this is a coordinated GitHub-advisory disclosure (GHSA-m723-r867-wfgw) with a vendor patch, which fits a low-urgency, patch-on-schedule posture. One important mitigating signal: access to internal/private addresses remains constrained when REDASH_ENFORCE_PRIVATE_IP_BLOCK is enabled, meaning classic cloud-metadata/internal-network SSRF is only reachable in deployments that have NOT enabled that protection. Net: real priority for internet-facing Redash instances with Basic-Auth data sources, but the authentication requirement and the optional IP-block mitigation keep real-world risk in the medium band.

An authenticated analyst with execute_query permission creates or runs a JSON data source query whose URL is an absolute address pointing at an attacker-controlled server (e.g. https://attacker.example/capture). Because the vulnerable code used urljoin, the absolute URL replaces the configured base_url entirely, so the Redash server issues the request server-side; if the data source has HTTP Basic Auth configured, the username and password are transmitted to the attacker's origin. Where REDASH_ENFORCE_PRIVATE_IP_BLOCK is disabled, the same technique can be aimed at internal services. No public exploit is identified, but the fix commit ships unit tests demonstrating the bypass.