Redash is a niche business-intelligence and data-visualization platform with a narrow product footprint, yet one that operates in a sensitive role connecting to upstream data sources and serving analytics to downstream users. Its vulnerability profile centers on web-application and request-handling weaknesses, including server-side request forgery, cross-site request forgery, injection flaws, insecure defaults, and open redirects—patterns consistent with a browser-based dashboard product that bridges multiple trust boundaries. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Redash over time
Signals from CVEs in this vendor scope (5 CVEs).
5 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-41192MEDIUM Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying the `REDASH_COOKIE_SECRET` or `REDASH_SEC | Nov 24, 2021 | 6.5 | 36 | NO | YES |
CVE-2021-43780HIGH Redash is a package for data visualization and sharing. In versions 10.0 and priorm the implementation of URL-loading data sources like JSON, CSV, or Excel is vulnerable to advance | Nov 24, 2021 | 8.8 | 28 | NO | NO |
CVE-2021-43777MEDIUM Redash is a package for data visualization and sharing. In Redash version 10.0 and prior, the implementation of Google Login (via OAuth) incorrectly uses the `state` parameter to p | Nov 24, 2021 | 6.1 | 21 | NO | NO |
CVE-2020-12725HIGH Havoc Research discovered an authenticated Server-Side Request Forgery (SSRF) via the "JSON" data source of Redash open-source 8.0.0 and prior. Possibly, other connectors are affec | Jun 11, 2020 | 7.2 | 21 | NO | NO |
CVE-2020-36144MEDIUM Redash 8.0.0 is affected by LDAP Injection. There is an information leak through the crafting of special queries, escaping the provided template since the username included in the | Mar 18, 2021 | 5.3 | 19 | NO | NO |
Signals from CVEs in this vendor scope (5 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Redash.
Media articles that mention a CVE ID that affects a product developed by Redash — matched by CVE ID, not by vendor name.