CVE Feed

    Dashboard / CVE / CVE-2026-33213

    CVE-2026-33213

    Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the get_next_path() function in Redash's authentication module stripped the scheme and netloc from user-supplied next parameters but did not normalize multiple leading slashes, allowing a crafted login URL such as /login?next=////evil.com to redirect users to an external attacker-controlled site after authentication.

    Published:Jul 15, 2026
    Last Modified:Aug 18, 2026
    EPS:Jul 15, 2026
    EPSS Score:0.00178
    CVSS Score:6.1

    Affected Products

    Vendor
    Redash
    Product
    Redash

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-178 Cross-Site Flashing

    Related CVEs

    CVE-2025-5874 (CVSS 1.2) — A vulnerability was found in Redash up to 10.1.0/25.1.0. It has been rated as problematic. This issue affects …
    CVE-2021-43780 (CVSS 6.8) — Redash is a package for data visualization and sharing. In versions 10.0 and priorm the implementation of URL-…
    CVE-2021-41192 (CVSS 8.1) — Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior w…
    CVE-2021-43777 (CVSS 6.8) — Redash is a package for data visualization and sharing. In Redash version 10.0 and prior, the implementation o…
    CVE-2020-36144 (CVSS 5.3) — Redash 8.0.0 is affected by LDAP Injection. There is an information leak through the crafting of special queri…
    CVE-2020-12725 (CVSS 7.2) — Havoc Research discovered an authenticated Server-Side Request Forgery (SSRF) via the "JSON" data source of Re…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High