Redash: SQL injection via Query Results parameters
Summary
Redash, a tool for data visualization and sharing, passes attacker-controlled parameters from the Query Results data source into a referenced query without proper validation. An authenticated user with view-only access to both data sources can inject SQL and run it with the privileges of the referenced data source. The attacker needs a valid account, so the risk is mainly for shared instances where users have different data-source permissions.
Affected
- Redash versions after 8.0.0 up to 26.9.0
- Exact lower boundary at 8.0.0: unverified
Fixed in
- Redash 26.9.0 (advisory GHSA-v43x-rgcc-wh77)
Workaround
- No workaround documented. Upgrading is the fix.
- Interim measure (not from the vendor): until the upgrade, remove view-only access to Query Results data sources and referenced data sources that is not needed.
Exploitation
- No evidence of exploitation in the wild.
- CISA SSVC: exploitation 'poc', automatable 'no', technical impact 'total'.
- No verified public exploit found. EPSS about 0.7%.
- Not listed in CISA KEV.
Our recommendation
- Upgrade to Redash 26.9.0. Back up the metadata database first and upgrade the web application, scheduler and all workers together.
- Test dashboards and scheduled queries after the upgrade, because queries with text-pattern parameters now require full data-source access.
- Until the upgrade, review which users have view-only access to Query Results and the data sources they reference.
- Prioritise shared instances with users of different data-source permissions.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GHSA-v43x-rgcc-wh77 security advisory github.com
- Redash v26.9.0 release github.com
- Fix commit 048bcd9 github.com
- OSV entry CVE-2026-42093 osv.dev
- CISA ADP Vulnrichment CVE-2026-42093 vulners.com
- OpenCVE CVE-2026-42093 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:48.
Original description (NVD)
Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-controlled values to replace_query_parameters() for raw substitution into a referenced query's SQL. This path bypassed the ParameterizedQuery schema validation used by normal query execution and omitted the is_safe permission check. An authenticated user with at least view-only access to both the Query Results data source and the referenced data source could therefore inject SQL through text parameters and execute it with the referenced data source's privileges. This issue is fixed in version 26.9.0.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.