CVE-2026-42093 getredash CVE debrief

Who should care

Defenders responsible for Redash installations, security teams, and administrators of data visualization and sharing platforms should assess exposure and apply the patch to prevent SQL injection attacks.

Why it matters

The CVE-2026-42093 vulnerability in Redash allows an authenticated user to inject SQL through text parameters and execute it with the referenced data source's privileges, potentially leading to data breaches and unauthorized access.

• An authenticated user could inject SQL through text parameters and execute it with the referenced data source's privileges.
• The vulnerability allows for potential data breaches and unauthorized access to sensitive information.
• Defenders need to verify exposure and apply the patch to prevent SQL injection attacks.
• The vulnerability requires verification of Redash versions and patch application to prevent exploitation.

Technical summary

The Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-controlled values to replace_query_parameters() for raw substitution into a referenced query's SQL. This path bypassed the ParameterizedQuery schema validation used by normal query execution and omitted the is_safe permission check. An authenticated user with at least view-only access to both the Query Results data source and the referenced data source could therefore inject SQL through text parameters and execute it with the referenced data source's privileges.

Defensive priority

Defenders should prioritize verifying exposure and applying the patch to prevent SQL injection attacks.

Recommended defensive actions

• Verify the versions of Redash in use and check if they are within the affected range.
• Apply the patch by updating to version 26.9.0 or later.
• Restrict access to the Query Results data source and referenced data sources to minimize the attack surface.
• Monitor for suspicious activity and implement additional security measures to detect potential SQL injection attacks.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The vulnerability exists in Redash versions after 8.0.0 until 26.9.0. An authenticated user with at least view-only access to both the Query Results data source and the referenced data source could inject SQL through text parameters.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.