CVE-2026-42093 Details
Description
Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-controlled values to replace_query_parameters() for raw substitution into a referenced query's SQL. This path bypassed the ParameterizedQuery schema validation used by normal query execution and omitted the is_safe permission check. An authenticated user with at least view-only access to both the Query Results data source and the referenced data source could therefore inject SQL through text parameters and execute it with the referenced data source's privileges. This issue is fixed in version 26.9.0.
A SQL injection vulnerability has been identified in Redash versions 8.0.0 prior to 26.9.0. The issue arises in the Query Results query runner, specifically within the 'replace_query_parameters' function of 'redash/query_runner/query_results.py'. This function accepts 'param_query_N_{key=value}' parameters and improperly handles user-supplied values by directly substituting them into SQL queries without proper validation. As a result, an authenticated user with view-only access to both the Query Results data source and the referenced SQL data source can inject and execute arbitrary SQL, exploiting the privileges of the latter data source.
Users can upgrade to Redash version 26.9.0, which addresses this vulnerability by applying proper parameter validation and enforcing the necessary permission checks. For those unable to upgrade immediately, it is recommended to restrict access to the Query Results data source or disable it altogether.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getredash/redash/security/advisories/GHSA-v43x-rgcc-wh77 | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/getredash/redash/commit/048bcd9fe7208e42f2f0cdf007d7e9dcb82829d8 | [email protected] | Source CodeVendor |
| https://github.com/getredash/redash/releases/tag/v26.9.0 | [email protected] | Release NotesVendor |
| https://github.com/getredash/redash/security/advisories/GHSA-v43x-rgcc-wh77 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-89 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Redash | > 8.0.0 (semver) < 26.9.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 14, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |