The vulnerability arises from the JSON data source query runner using a URL manipulation routine that concatenates a user‑supplied query URL with a configured base URL via urljoin. If the query URL is absolute, it overwrites the intended base URL, allowing a user with execute_query permission to instruct the server to send HTTP requests to any external origin. When HTTP Basic Authentication is enabled for the data source, the credentials are forwarded to the target host, potentially exposing them.

Redash versions from 10.0.0 up to but not including 26.9.0 are affected. The issue is present in the getredash:redash product and is resolved starting with release 26.9.0.

The CVSS score of 4.9 indicates moderate severity; the EPSS score indicates a very low exploitation probability (<1%), and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have execute_query privileges on Redash; the attack does not require remote code execution but can lead to information disclosure or credential leakage when HTTP Basic Auth is used.