CVE-2021-41192

CVE-2021-41192 impacts Redash versions 10.0.0 and prior where administrators have not explicitly set the REDASH_COOKIE_SECRET or REDASH_SECRET_KEY environment variables, leading to the use of a common default value. This allows attackers to forge sessions due to the known default secret. The vulnerability has a CVSS score of 6.5 (Medium), indicating a network attack vector with low complexity, requiring low privileges, and resulting in high integrity impact. While not in CISA's KEV catalog, its high EPSS score (0.87778) and FAUCET Risk Score (99/100) suggest a high likelihood of exploitation. Although no Metasploit or ExploitDB modules exist, Nuclei templates are available for detection, and there's notable community discussion and media coverage, indicating awareness and potential for future exploitation.