{"metadata": {"vulnerability": "CVE-2026-77371", "count": 13, "kinds": {"milestone": 3, "sighting": 4, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-08-20T19:36:13.805Z", "date_only": false, "value": "2026-08-20T19:36:13.805Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-77371", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-14T18:02:07.208Z", "date_only": false, "value": "2026-10-14T18:02:07.208Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-77371", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-14T18:02:07.208Z", "date_only": false, "value": "2026-10-14T18:02:07.208Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / GitHub_M", "record": "CVE-2026-77371", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T18:18:18.570Z", "date_only": false, "value": "2026-10-14T18:18:18.570", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77371", "record": "FKIE_CVE-2026-77371", "field": "published"}, {"timestamp": "2026-10-14T19:35:55.829Z", "date_only": false, "value": "2026-10-14T19:35:55.829497Z", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-77371", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-10-14T19:35:55.829Z", "date_only": false, "value": "2026-10-14T19:35:55.829497Z", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77371", "record": "FKIE_CVE-2026-77371", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-10-14T19:36:16.578Z", "date_only": false, "value": "2026-10-14T19:36:16.578Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-77371", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-14T19:36:16.578Z", "date_only": false, "value": "2026-10-14T19:36:16.578Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-77371", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-14T20:10:06.275Z", "date_only": false, "value": "2026-10-14T20:10:06.275364Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mxue47sclj24", "record": "CVE-2026-77371", "field": "creation_timestamp", "uuid": "bcbd832e-6f9d-469d-87a1-a0866ea518a1", "content": "CVE-2026-77371 - redash\nVersions 26.0.0 through 26.9.0 of Redash let a user who can run DuckDB queries read any file the Redash service can access or write files to the server. This could expose secret\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#redash #getredash #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mxue47sclj24"}, {"timestamp": "2026-10-14T20:11:31.885Z", "date_only": false, "value": "2026-10-14T20:11:31.885055Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mxue6rogcl2l", "record": "CVE-2026-77371", "field": "creation_timestamp", "uuid": "e7742d92-8334-4d06-bacf-78690c93770e", "content": "\ud83d\udea8 CVE-2026-77371 \u2014 CVSS 9.3 CRITICAL\n\nRedash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-77371\n\n#CVE #CyberSecurity #InfoSec", "url": "https://bsky.app/profile/stemshop.bsky.social/post/3mxue6rogcl2l"}, {"timestamp": "2026-10-14T23:33:45.969Z", "date_only": false, "value": "2026-10-14T23:33:45.969953Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117441876807662284", "record": "CVE-2026-77371", "field": "creation_timestamp", "uuid": "9f6a8add-65ab-466e-922e-b6eede1e6d1b", "content": "CVE-2026-77371 Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access Redash is a package for data visualization and sharing. From 26.0.0 until 26.9.0, the DuckDB query runner's _connect() path in redash/query_runner/duckdb.py created connections with enable_external_access left at its default value of true. A user with query access to an administrator-created DuckDB data source could use native file-reading functions to retrieve files readable by the Redash process or use COPY TO to write files with that process's privileges. Reading application secrets such as REDASH_COOKIE_SECRET or REDASH_SECRET_KEY could also enable forged sessions and authentication bypass. This issue is fixed in version 26.9.0.\nhttps://www.cve.org/CVERecord?id=CVE-2026-77371https://github.com/getredash/redash/security/advisories/GHSA-cr68-3xxj-cg9fhttps://github.com/getredash/redash/commit/7387072af40913a64e7b3be470491792f2d5551chttps://github.com/getredash/redash/releases/tag/v26.9.0#getredash #redash#CVE_2026_77371#bot", "url": "https://infosec.exchange/users/cve/statuses/117441876807662284"}, {"timestamp": "2026-10-15T03:53:26.769Z", "date_only": false, "value": "2026-10-15T03:53:26.769516Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnsea.com/post/3mxv5yqml3k24", "record": "CVE-2026-77371", "field": "creation_timestamp", "uuid": "9b18fa5e-7467-4616-8331-1ff2602732cb", "content": "\ud83c\udf0a ABYSSAL \u00b7 critical with a public exploit\nCVE-2026-77371: Redash is a package for data visualization and sharing\nCVSS 9.3\nhttps://beta.vulnsea.com/cve/CVE-2026-77371\n\n#CVE #infosec #cybersecurity #threatintel", "url": "https://bsky.app/profile/vulnsea.com/post/3mxv5yqml3k24"}, {"timestamp": "2026-10-16T16:00:33.533Z", "date_only": false, "value": "2026-10-16T16:00:33.533", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-77371", "record": "FKIE_CVE-2026-77371", "field": "lastModified"}]}