{"record":{"id":"f6587742ebb25173","repo":"apache/superset","slug":"query-security-access-error","errorCode":"QUERY_SECURITY_ACCESS_ERROR","errorMessage":"Failed to execute %(query)s: can not access the query","messagePattern":"Failed to execute (.+?): can not access the query","errorType":"exception","errorClass":"QueryIsForbiddenToAccessException","httpStatus":500,"severity":"error","filePath":"superset/commands/sql_lab/execute.py","lineNumber":213,"sourceCode":"            self._query_dao.create(query)\n        except SQLAlchemyError as ex:\n            raise SqlLabException(\n                self._execution_context,\n                SupersetErrorType.GENERIC_DB_ENGINE_ERROR,\n                \"The query record was not created as expected\",\n                ex,\n                \"Please contact an administrator for further assistance or try again.\",\n            ) from ex\n\n        db.session.commit()  # pylint: disable=consider-using-transaction\n\n    def _validate_access(\n        self, query: Query, template_params: Optional[dict[str, Any]] = None\n    ) -> None:\n        try:\n            self._access_validator.validate(query, template_params)\n        except Exception as ex:\n            raise QueryIsForbiddenToAccessException(self._execution_context, ex) from ex\n\n    def _set_query_limit_if_required(\n        self,\n        rendered_query: str,\n    ) -> None:\n        if self._is_required_to_set_limit():\n            self._set_query_limit(rendered_query)\n\n    def _is_required_to_set_limit(self) -> bool:\n        return not (\n            self._sqllab_ctas_no_limit and self._execution_context.select_as_cta\n        )\n\n    def _set_query_limit(self, rendered_query: str) -> None:\n        db_engine_spec = self._execution_context.database.db_engine_spec  # type: ignore\n        limits = [\n            db_engine_spec.get_limit_from_sql(rendered_query),\n            self._execution_context.limit,","sourceCodeStart":195,"sourceCodeEnd":231,"githubUrl":"https://github.com/apache/superset/blob/f4587218dd19d046c3e4d00063e7d27f8a2ed354/superset/commands/sql_lab/execute.py#L195-L231","documentation":"Raised as QueryIsForbiddenToAccessException when the access validator rejects a SQL Lab query before execution. In ExecuteSqlJsonCommand.run, _validate_access() delegates to self._access_validator.validate(query, template_params), which enforces database access, schema/dataset allowlists, and template-rendering security rules; any exception from that validator is re-raised as this error and the query is marked FAILED (execute.py:161-163).","triggerScenarios":"POST /api/v1/sqllab/execute/ where the user lacks 'database_access' on the target database (or a matching schema or RLS/dataset grant); a Jinja-enabled query whose template_params or SQL macro trips Superset's Jinja security checks; querying a database not present in the user's allowed databases via SQL Lab.","commonSituations":"A Gamma/Alpha user runs SQL Lab against a database they were never granted access to; an admin removes a user's database permission but the user still has an old SQL Lab tab open; Jinja macro in the query calls a blocked function (e.g. os module access) with SQLLAB_TEMPLATE_EDITING or feature restrictions enabled.","solutions":["Grant the user access to the database (Admin: Settings > List Databases > Edit, add user/role under 'Security'), or grant schema-level access, then retry the query","Verify the user holds the sql_lab role/permission and that the target database allows SQL Lab access for their roles (check the database's 'ALLOWED ROLES' / security conventions)","If Jinja templates are involved, audit template_params and macros against Superset's allowed Jinja context; remove blocked calls or enable the required feature flags deliberately","Check the exception chain in logs (the original validator error is preserved via 'from ex') to identify exactly which access rule failed"],"exampleFix":"# before: Gamma user runs\nSELECT * FROM secret_schema.payroll;\n# -> QueryIsForbiddenToAccessException: can not access the query\n\n# after: admin grants schema access, or user queries a permitted schema\nSELECT * FROM public.orders LIMIT 100;","handlingStrategy":"try-catch","validationCode":"from superset import security_manager\nfrom superset.models.core import Database\n\ndef can_run_query(user, database_id) -> bool:\n    db = db.session.get(Database, database_id)\n    return db is not None and security_manager.can_access_database(db)","typeGuard":null,"tryCatchPattern":"try:\n    ExecuteSqlJsonCommand(...).run()\nexcept QueryIsForbiddenToAccessException as ex:\n    # surface the nested access reason; prompt for permission grant, do not retry\n    report_permission_error(ex)","preventionTips":["Pre-validate database/schema access with security_manager.can_access_database before submitting the query","Keep Jinja templates within Superset's allowed macro context","Audit role grants whenever users report SQL Lab access failures instead of retrying"],"tags":["sql-lab","authorization","rbac","jinja"],"backgroundTag":null,"analyzedSha":"f4587218dd19d046c3e4d00063e7d27f8a2ed354","analyzedAt":"2026-08-14T22:39:27.425Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}