CVE-2026-42093
Deferred Deferred - Pending Action

SQL Injection in Redash Query Results

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description
Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-controlled values to replace_query_parameters() for raw substitution into a referenced query's SQL. This path bypassed the ParameterizedQuery schema validation used by normal query execution and omitted the is_safe permission check. An authenticated user with at least view-only access to both the Query Results data source and the referenced data source could therefore inject SQL through text parameters and execute it with the referenced data source's privileges. This issue is fixed in version 26.9.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-16
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-42093
EUVD
EUVD-2026-101515

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
getredash redash > 8.0.0, < 26.9.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a SQL injection flaw in Redash's Query Results feature. It affects versions after 8.0.0 until 26.9.0. The issue occurs because user-controlled parameters are directly inserted into SQL queries without proper validation. Attackers with view-only access can inject malicious SQL commands through text parameters, bypassing security checks and executing arbitrary queries with the referenced data source's privileges.

Detection Guidance

To detect this vulnerability, check if your Redash instance is running a version between 8.0.0 and 26.9.0. Verify if the Query Results query runner is enabled and if any users have view-only access to both the Query Results data source and referenced data sources. Look for unusual SQL queries or parameter substitutions in logs.

Impact Analysis

An attacker could exploit this to execute arbitrary SQL commands on your database, potentially stealing, modifying, or deleting sensitive data. Since the attack requires only view-only access to a Query Results data source, even users with limited permissions could cause significant damage. The impact includes data breaches, unauthorized data manipulation, and potential system compromise depending on the database's role.

Compliance Impact

This vulnerability could lead to violations of GDPR, HIPAA, and other regulations by enabling unauthorized access to personal or health data. GDPR requires protecting personal data, while HIPAA mandates safeguards for health information. A successful SQL injection could result in data breaches, triggering regulatory fines, legal penalties, and reputational damage for organizations handling sensitive data.

Mitigation Strategies

Immediately upgrade Redash to version 26.9.0 or later. As a temporary workaround, restrict access to Query Results data sources to users with full data source access only. Review and regenerate any potentially exposed API keys and review alert query assignments after upgrading.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-42093. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart