CVE-2026-41490 - Vulnerability Analysis

Overview

Dagster Core < 1.13.1 and Dagster libraries < 0.29.1 contain a SQL injection caused by unescaped dynamic partition key values in SQL WHERE clauses in DuckDB, Snowflake, BigQuery, and DeltaLake I/O managers, letting users with Add Dynamic Partitions permission execute arbitrary SQL under I/O manager credentials, exploit requires use of dynamic partitions.

Severity & Score

Impact

Users with Add Dynamic Partitions permission can execute arbitrary SQL on target databases, potentially compromising data integrity and confidentiality.

Mitigation

Upgrade Dagster Core to version 1.13.1 and Dagster libraries to version 0.29.1 or later.

References

• https://github.com/dagster-io/dagster/releases/tag/1.13.1
• https://github.com/dagster-io/dagster/security/advisories/GHSA-mjw2-v2hm-wj34

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner