Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

getredash/redash

              master @ ca79fe9
            

Fixes

CVEs

CRITICAL

Peak severity

34.2%

Coverage

Highlights

Auth Bypass: 26 prior fixes. Scrutinize any change in this area.

redash/authentication/__init__.py: most-fixed (7 issues). Treat as high-risk during review.

46 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Multiple critical and high-severity auth bypasses were fixed, including disabled users authenticating via API keys, session fixation, and missing permission decorators on API endpoints.

Access Control: Multiple access control bypasses were fixed in query execution and result retrieval, especially via dropdown queries and embeds, indicating a pattern of missing permission checks on indirect execution paths.

XSS: Multiple XSS vulnerabilities were fixed by replacing or hardening HTML sanitization and markdown rendering libraries, indicating a recurring risk from unsafe rendering of user content.