CVE-2026-33213 Redash: Open redirect vulnerability in post-login redirect handling
Attackers can redirect authenticated users to malicious sites via crafted login URLs, potentially facilitating phishing attacks against Redash users.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-33213?
CVE-2026-33213 is a medium-severity vulnerability in getredash redash, published on 15 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Redash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the get_next_path() function in Redash's authentication module stripped the scheme and netloc from user-supplied next parameters but did not normalize multiple leading slashes, allowing a crafted login URL such as /login?next=////evil.com to redirect users to an external attacker-controlled site after authentication.
Weakness: CWE-601
Which versions are affected by CVE-2026-33213?
It affects 1 product.
Products include Redash Redash.
How do I fix CVE-2026-33213?
No fix has been published for CVE-2026-33213 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-33213 being exploited?
There is no known exploitation of CVE-2026-33213 in the wild and no public exploit code.
Other vulnerabilities in getredash redash
- CVE-2021-41192 Insecure default configuration
- CVE-2020-12725 Server-side request forgery in n/a
- CVE-2021-43777 Vulnerability in Redash OAuth2 flows due to misuse of state field (should be a nonce)
- CVE-2021-43780 Server-Side Request Forgery (SSRF) in Redash
- CVE-2020-36144 Information disclosure in n/a
Sources
Also known as GHSA-rfgc-hc86-pxrv.