CVE-2026-42093 | getredash Redash up to 26.8.x Query Results Query Runner query_results.py replace_query_parameters param_query_N sql injection

October 14, 2026 Yanac

A vulnerability was found in getredash Redash up to 26.8.x. It has been classified as critical. This affects the function replace_query_parameters of the file redash/query_runner/query_results.py of the component Query Results Query Runner. Performing a manipulation of the argument param_query_N results in sql injection.

This vulnerability is known as CVE-2026-42093. Remote exploitation of the attack is possible. No exploit is available.

Upgrading the affected component is recommended.VulDB Recent EntriesRead More