Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2021-41192: Redash 10.0.0 and prior: Default Secrets Make Sessions Vulnerable

CVE-2021-41192 · published 4 years ago

Summary

Redash installations without custom secrets are at risk of session forgery. This affects local installations of Redash versions 10.0.0 and prior, but not cloud or pre-configured versions. To secure your instance, check if the `REDASH_COOKIE_SECRET` environment variable is set to a specific default value and follow the provided instructions to change it to a unique secret.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
redash	redash	<= 10.0.0 `cpe:2.3:a:redash:redash::::::::`

Original advisory text

Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying the `REDASH_COOKIE_SECRET` or `REDASH_SECRET_KEY` environment variables, a default value is used for both that is the same across all installations. In such cases, the instance is vulnerable to attackers being able to forge sessions using the known default value. This issue only affects installations where the `REDASH_COOKIE_SECRET or REDASH_SECRET_KEY` environment variables have not been explicitly set. This issue does not affect users of the official Redash cloud images, Redash's Digital Ocean marketplace droplets, or the scripts in the `getredash/setup` repository. These instances automatically generate unique secret keys during installation. One can verify whether one's instance is affected by checking the value of the `REDASH_COOKIE_SECRET` environment variable. If it is `c292a0a3aa32397cdb050e233733900f`, should follow the steps to secure the instance, outlined in the GitHub Security Advisory.

References

https://github.com/getredash/redash/commit/ce60d20c4e3d1537581f2f70f1308fe77ab6a... Patch Third Party Advisory
https://github.com/getredash/redash/security/advisories/GHSA-g8xr-f424-h2rv Third Party Advisory
https://ian.sh/redash Exploit Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Exploitation

8% chance of attack within 30 days

Type

CWE-1188Initialization of a Resource with an Insecure Default

Timeline

Published24 Nov 2021

Updated16 Oct 2026

First seen9 Jul 2026

Sources

CVE-2021-41192 · OSV

GHSA-g8xr-f424-h2rv · GHSA

CVE-2021-41192 · NVD

Track software like this

Free during beta