A vulnerability in the DuckDB query runner of the Redash data visualization tool allows a user with query access to an administrator‑created DuckDB data source to read or write any file accessible to the Redash process. The flaw arises because the _connect() method leaves enable_external_access set to its default true value. This permits use of native file‑reading functions or COPY TO commands, enabling the extraction of application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY and potentially leading to credential theft or session forging. The weakness is an improper access control flaw (CWE-284).

The issue affects instances of Redash version 26.0.0 through 26.8.x inclusive. The vulnerability was addressed in Redash 26.9.0 and later releases. Products governed by the getredash:redash CNA are impacted when running any affected version without the patch.

With a CVSS score of 9.3, this vulnerability poses a severe risk to confidentiality, integrity, and availability. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the high CVSS indicates a high likelihood of exploitation. Attackers can leverage the Redash web interface or API to issue DuckDB queries; if the Redash service runs under a privileged account, successful exploitation would grant file system access with those privileges. The absence of a mitigations change in the original code means the flaw remains exploitable until the patch or manual mitigation is applied.