Read the docs
TI-2026-74373 Aliases CVE-2026-42093

SQL injection in Redash Query Results parameter substitution

Priority HIGH 73CWE-89Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
SQL injection
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-89.

Summary

Redash versions after 8.0.0 before 26.9.0 contain an SQL injection flaw (CWE-89) in the Query Results query runner. Attacker-controlled values passed through param_query_N_ parameters are substituted into a referenced query's SQL without the validation and permission checks used in normal execution. An authenticated user with view-only access to both the Query Results data source and the referenced data source can inject SQL through text parameters and run it with the referenced data source's privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Redash is a package for data visualization and sharing. From versions after 8.0.0 until 26.9.0, the Query Results query runner in redash/query_runner/query_results.py accepts param_query_N_{key=value} parameters and passed attacker-controlled values to replace_query_parameters() for raw substitution into a referenced query's SQL. This path bypassed the ParameterizedQuery schema validation used by normal query execution and omitted the is_safe permission check. An authenticated user with at least view-only access to both the Query Results data source and the referenced data source could therefore inject SQL through text parameters and execute it with the referenced data source's privileges. This issue is fixed in version 26.9.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00684 52nd percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
getredashredash> 8.0.0, < 26.9.0—No fix listedCNA
  • redash Vendorgetredash Affected > 8.0.0, < 26.9.0 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:redash:redash:*:*:*:*:*:*:*:*——getredash
  • cpe:2.3:a:redash:redash:*:*:*:*:*:*:*:* Versions — — ·getredash

Remediation

Upgrade Redash to version 26.9.0, which fixes this issue. CISA KEV does not list this vulnerability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-42093

References

Other 3

  • TI-2026-74378 Redash DuckDB query runner lets users read and write arbitrary files CVSS 4.0CRITICAL 9.3
  • TI-2021-18031 Insecure default configuration CVSS 3.1HIGH 8.1
  • TI-2021-19587 Server-Side Request Forgery (SSRF) in Redash CVSS 3.1HIGH 8.8
  • TI-2020-10116 Havoc Research discovered an authenticated Server-Side Request Forgery (SSRF) via the… CVSS 3.1HIGH 7.2
  • TI-2021-19584 Vulnerability in Redash OAuth2 flows due to misuse of state field (should be a nonce) CVSS 3.1MEDIUM 6.8
  • TI-2026-25634 Redash: Open redirect vulnerability in post-login redirect handling CVSS 3.1MEDIUM 6.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences