Redash’s Query Results query runner, active for versions 8.0.0 through 26.9.0, processes URLs containing param_query_N_… segments that pass attacker‑controlled values to replace_query_parameters() for raw substitution into a referenced query’s SQL. This bypasses the normal ParameterizedQuery schema validation and omits the is_safe permission check. An authenticated user who has at least view‑only access to both the Query Results data source and the referenced data source can thus inject arbitrary SQL and run it with the referenced data source’s privileges, enabling data exfiltration, unauthorized modification, or escalation of privileges within the database.

The vulnerability affects installations of getredash: redash from version 8.0.0 up to, but not including, 26.9.0. Any Redash deployment that has not been updated to 26.9.0 or later is susceptible. The affected component is the Query Results query runner located in redash/query_runner/query_results.py, operating within the Redash application framework.

The CVSS base score of 8.7 classifies this flaw as High severity. The EPSS score is <1%, indicating a very low probability of exploitation in the wild. The vulnerability is not listed in CISA’s KEV catalog. The likely attack vector requires an authenticated session with at least view‑only permissions on the relevant data sources; once those conditions are met, exploitation is straightforward via the web interface, allowing arbitrary SQL execution with the data source’s privileges.