CVE-2026-42093 in Redash
Summary
by MITRE • 10/14/2026
Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-controlled values to replace_query_parameters() for raw substitution into a referenced query's SQL. This path bypassed the ParameterizedQuery schema validation used by normal query execution and omitted the is_safe permission check. An authenticated user with at least view-only access to both the Query Results data source and the referenced data source could therefore inject SQL through text parameters and execute it with the referenced data source's privileges. This issue is fixed in version 26.9.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/14/2026
The vulnerability identified within Redash, a popular open-source platform for data visualization and sharing, represents a critical failure in input validation and access control mechanisms when handling query results from external sources. Specifically affecting versions released after 8.0.0 up to version 26.9.0, this flaw resides in the Query Results query runner located at redash/query_runner/query_results.py. The core technical issue stems from how the application processes parameters passed via the param_query_N_{key=value} structure. When a user submits such parameters containing attacker-controlled values, these inputs are directly forwarded to the replace_query_parameters() function for raw substitution into an SQL statement associated with a referenced query. This process bypasses the standard ParameterizedQuery schema validation that is typically enforced during normal query execution workflows. By circumventing this layer of defense, the application fails to sanitize or validate the structure and content of the injected data before it becomes part of the executable SQL command.
Furthermore, the vulnerability exploits a significant gap in permission checking logic. The code path utilized for processing these parameters omits the is_safe permission check that would normally be applied when executing queries against sensitive data sources. This omission allows an authenticated user who possesses at least view-only access to both the Query Results data source and the referenced target data source to escalate their privileges effectively. Although the user may only have read permissions on the individual components, the combination of bypassed validation and missing permission checks enables them to inject arbitrary SQL commands that are executed with the higher-level privileges associated with the referenced data source itself. This discrepancy between intended access controls and actual execution behavior creates a severe security risk where low-privileged users can perform actions far beyond their authorized scope.
The operational impact of this vulnerability is substantial, as it facilitates Remote Code Execution in the context of database operations through SQL Injection. An attacker could potentially extract sensitive data from databases that should be protected by stricter access controls, modify or delete critical records, and even execute administrative commands depending on the underlying database engine's capabilities and configuration. This undermines the fundamental principle of least privilege within the Redash environment, allowing lateral movement across different datasets and compromising the integrity and confidentiality of organizational data assets. The ability to inject SQL through text parameters means that complex payloads can be crafted to exfiltrate information or disrupt services without triggering standard security alerts associated with direct query submissions.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) categories such as CWE-89, which describes Improper Neutralization of Special Elements used in an SQL Command, commonly known as SQL Injection. Additionally, it relates to CWE-269 regarding the Use of Incorrectly Resolved Permission or Privilege, highlighting the failure to enforce proper access control checks before executing privileged operations. From a tactical perspective within the MITRE ATT&CK framework, this flaw supports techniques associated with Data Exfiltration and Defense Evasion, as attackers can use legitimate application features to bypass security monitoring and extract data undetected. The exploitation relies on authenticated interaction but leverages misconfigured validation logic rather than breaking authentication protocols directly.
To mitigate this risk, organizations running Redash must upgrade immediately to version 26.9.0 or later, where the issue has been resolved by enforcing proper parameterization and restoring necessary permission checks for all query execution paths. Until upgrading is possible, administrators should restrict access to Query Results data sources strictly to trusted users who require such functionality and ensure that referenced data sources do not hold excessive privileges beyond what is necessary for their specific operational needs. Implementing a Web Application Firewall with rules capable of detecting SQL injection patterns in parameterized fields may provide an additional layer of defense, although it should not be relied upon as the primary mitigation strategy given the application-level nature of the flaw. Regular security audits and code reviews focusing on how external inputs are processed before database interaction can help prevent similar vulnerabilities in future development cycles.