← Vulnerability feed

Vulnerability record · CVE-2021-41192 · published 24 November 2021

CVE-2021-41192: Redash insecure default initialization vulnerability

Redash · Redash

Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying the `REDASH_COOKIE_SECRET` or `REDASH_SECRET_KEY` environment variables, a default value is used for both that is the same across all installations. In such cases, the instance is vulnerable to attackers being able to forge sessions using the known default value. This issue only affects installations where the `REDASH_COOKIE_SECRET or REDASH_SECRET_KEY` environment variables have not been explicitly set. This issue does not affect users of the official Redash cloud images, Redash's Digital Ocean marketplace droplets, or the scripts in the `getredash/setup` repository. These instances automatically generate unique secret keys during installation. One can verify whether one's instance is affected by checking the value of the `REDASH_COOKIE_SECRET` environment variable. If it is `c292a0a3aa32397cdb050e233733900f`, should follow the steps to secure the instance, outlined in the GitHub Security Advisory.

6.5 CVSS 3.1 Medium EPSS 8.1% · top 5.3% CWE-1188 · Insecure default initialization
6.5CVSS 3.1 base score, v2 3.5
8.1%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Redash is a package for data visualization and sharing. If an admin sets up Redash versions 10.0.0 and prior without explicitly specifying the `REDASH_COOKIE_SECRET` or `REDASH_SECRET_KEY` environment variables, a default value is used for both that is the same across all installations. In such cases, the instance is vulnerable to attackers being able to forge sessions using the known default value. This issue only affects installations where the `REDASH_COOKIE_SECRET or REDASH_SECRET_KEY` environment variables have not been explicitly set. This issue does not affect users of the official Redash cloud images, Redash's Digital Ocean marketplace droplets, or the scripts in the `getredash/setup` repository. These instances automatically generate unique secret keys during installation. One can verify whether one's instance is affected by checking the value of the `REDASH_COOKIE_SECRET` environment variable. If it is `c292a0a3aa32397cdb050e233733900f`, should follow the steps to secure the instance, outlined in the GitHub Security Advisory.

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/getredash/redash/commit/ce60d20c4e3d1537581f2f70f1308fe77ab6a214 PatchThird Party Advisory
https://github.com/getredash/redash/security/advisories/GHSA-g8xr-f424-h2rv Third Party Advisory
https://ian.sh/redash ExploitThird Party Advisory
https://github.com/getredash/redash/commit/ce60d20c4e3d1537581f2f70f1308fe77ab6a214 PatchThird Party Advisory
https://github.com/getredash/redash/security/advisories/GHSA-g8xr-f424-h2rv Third Party Advisory
https://ian.sh/redash ExploitThird Party Advisory

Track CVE-2021-41192 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2021-43780Redash server-side request forgery (ssrf) vulnerabilityRedash is a package for data visualization and sharing. In versions 10.0 and priorm the implementation of URL-loading data sources like JSON, CSV, or…EPSS 1.0%7.2CVE-2020-12725Redash server-side request forgery (ssrf) vulnerabilityHavoc Research discovered an authenticated Server-Side Request Forgery (SSRF) via the "JSON" data source of Redash open-source 8.0.0 and prior. Possi…EPSS 1.3%6.1CVE-2026-33213Redash open redirect vulnerabilityRedash is a package for data visualization and sharing. From 5.0.2 to 26.3.0, the get_next_path() function in Redash's authentication module stripped…EPSS 0.31%6.1CVE-2021-43777Redash cross-site request forgery vulnerabilityRedash is a package for data visualization and sharing. In Redash version 10.0 and prior, the implementation of Google Login (via OAuth) incorrectly …EPSS 0.31%5.3CVE-2020-36144Redash injection vulnerabilityRedash 8.0.0 is affected by LDAP Injection. There is an information leak through the crafting of special queries, escaping the provided template sinc…EPSS 0.93%5.3CVE-2025-48927TeleMessage Spring Boot Actuator heap dump endpoint exposed by insecure defaultTeleMessage through 2025-05-05 ships with Spring Boot Actuator configured to expose the /heapdump endpoint. Because this is an insecure default initi…KEVEPSS 11%analysed9.8CVE-2023-27524Apache Superset default SECRET_KEY allows session forgery and auth bypassApache Superset versions up to and including 2.0.1 ship with a default SECRET_KEY that, if left unchanged, lets an attacker forge signed session cook…KEVEPSS 97%analysed9.8CVE-2023-6448Unitronics VisiLogic default admin password in Vision and Samba PLCs/HMIsUnitronics VisiLogic before 9.9.00, used with Vision and Samba PLCs and HMIs, ships with a default administrative password. Because the credential is…KEVEPSS 2.1%analysed

Source: NIST National Vulnerability Database (record CVE-2021-41192), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.