CVE-2026-42093: Redash: SQL Injection via Query Results parameterized query substitution
Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/queryrunner/queryresults.py accepts paramqueryN{key=value} parameters and passed attacker-controlled values to replacequeryparameters() for raw substitution into a referenced query's SQL. This path bypassed the ParameterizedQuery schema validation used by normal query execution and omitted the issafe permission check. An authenticated user with at least view-only access to both the Query Results data source and the referenced data source could therefore inject SQL through text parameters and execute it with the referenced data source's privileges. This issue is fixed in version 26.9.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redashto a version that resolves this vulnerability.Fixed in 26.9.0
Event History
Frequently Asked Questions
Which Redash deployments are affected?
Redash versions later than 8.0.0 and earlier than 26.9.0 are affected. Version 26.9.0 fixes the issue.
What access does an attacker need to exploit this?
The attacker must be authenticated and have at least view-only access to both the Query Results data source and the data source referenced by the query. They can supply crafted text parameter values through the Query Results query runner.
What is the impact of successful exploitation?
Injected SQL is executed with the privileges of the referenced data source. The vulnerable path bypasses normal ParameterizedQuery schema validation and does not enforce the is_safe permission check.
How can I determine whether my environment may be exposed?
Review whether your Redash version falls after 8.0.0 and before 26.9.0, and whether users with view-only access can use Query Results queries that reference other data sources. Queries accepting param_query_N_{key=value} parameters are the relevant execution path.
What should be done to remediate the issue?
Upgrade Redash to version 26.9.0. Until upgrading, restrict access so untrusted authenticated users do not have the required view permissions to both Query Results and referenced data sources.