apache/superset · error · QueryIsForbiddenToAccessException

QUERY_SECURITY_ACCESS_ERROR

QUERY_SECURITY_ACCESS_ERROR

Error message

Failed to execute %(query)s: can not access the query

What it means

Raised as QueryIsForbiddenToAccessException when the access validator rejects a SQL Lab query before execution. In ExecuteSqlJsonCommand.run, _validate_access() delegates to self._access_validator.validate(query, template_params), which enforces database access, schema/dataset allowlists, and template-rendering security rules; any exception from that validator is re-raised as this error and the query is marked FAILED (execute.py:161-163).

Source

Thrown at superset/commands/sql_lab/execute.py:213

            self._query_dao.create(query)
        except SQLAlchemyError as ex:
            raise SqlLabException(
                self._execution_context,
                SupersetErrorType.GENERIC_DB_ENGINE_ERROR,
                "The query record was not created as expected",
                ex,
                "Please contact an administrator for further assistance or try again.",
            ) from ex

        db.session.commit()  # pylint: disable=consider-using-transaction

    def _validate_access(
        self, query: Query, template_params: Optional[dict[str, Any]] = None
    ) -> None:
        try:
            self._access_validator.validate(query, template_params)
        except Exception as ex:
            raise QueryIsForbiddenToAccessException(self._execution_context, ex) from ex

    def _set_query_limit_if_required(
        self,
        rendered_query: str,
    ) -> None:
        if self._is_required_to_set_limit():
            self._set_query_limit(rendered_query)

    def _is_required_to_set_limit(self) -> bool:
        return not (
            self._sqllab_ctas_no_limit and self._execution_context.select_as_cta
        )

    def _set_query_limit(self, rendered_query: str) -> None:
        db_engine_spec = self._execution_context.database.db_engine_spec  # type: ignore
        limits = [
            db_engine_spec.get_limit_from_sql(rendered_query),
            self._execution_context.limit,

View on GitHub (pinned to f4587218dd)

Solutions

1. Grant the user access to the database (Admin: Settings > List Databases > Edit, add user/role under 'Security'), or grant schema-level access, then retry the query
2. Verify the user holds the sql_lab role/permission and that the target database allows SQL Lab access for their roles (check the database's 'ALLOWED ROLES' / security conventions)
3. If Jinja templates are involved, audit template_params and macros against Superset's allowed Jinja context; remove blocked calls or enable the required feature flags deliberately
4. Check the exception chain in logs (the original validator error is preserved via 'from ex') to identify exactly which access rule failed

Example fix

# before: Gamma user runs
SELECT * FROM secret_schema.payroll;
# -> QueryIsForbiddenToAccessException: can not access the query

# after: admin grants schema access, or user queries a permitted schema
SELECT * FROM public.orders LIMIT 100;

from superset import security_manager
from superset.models.core import Database

def can_run_query(user, database_id) -> bool:
    db = db.session.get(Database, database_id)
    return db is not None and security_manager.can_access_database(db)

try:
    ExecuteSqlJsonCommand(...).run()
except QueryIsForbiddenToAccessException as ex:
    # surface the nested access reason; prompt for permission grant, do not retry
    report_permission_error(ex)

When it happens

Trigger: POST /api/v1/sqllab/execute/ where the user lacks 'database_access' on the target database (or a matching schema or RLS/dataset grant); a Jinja-enabled query whose template_params or SQL macro trips Superset's Jinja security checks; querying a database not present in the user's allowed databases via SQL Lab.

Common situations: A Gamma/Alpha user runs SQL Lab against a database they were never granted access to; an admin removes a user's database permission but the user still has an old SQL Lab tab open; Jinja macro in the query calls a blocked function (e.g. os module access) with SQLLAB_TEMPLATE_EDITING or feature restrictions enabled.

Related errors

• Changing this dataset is forbidden.
• Changing this dataset is forbidden
• You don't have access to this dataset.
• User doesn't have permission to create or update databases
• Changing this report is forbidden

AI-assisted analysis of apache/superset@f4587218dd (2026-08-14). Data as JSON: /api/errors/f6587742ebb25173. Report an issue: GitHub.