diff --git a/sql/src/main/java/org/apache/druid/sql/http/SqlResource.java b/sql/src/main/java/org/apache/druid/sql/http/SqlResource.java
index <HASH>..<HASH> 100644
--- a/sql/src/main/java/org/apache/druid/sql/http/SqlResource.java
+++ b/sql/src/main/java/org/apache/druid/sql/http/SqlResource.java
@@ -29,6 +29,7 @@ import org.apache.druid.java.util.common.guava.Yielder;
 import org.apache.druid.java.util.common.guava.Yielders;
 import org.apache.druid.java.util.common.logger.Logger;
 import org.apache.druid.query.QueryInterruptedException;
+import org.apache.druid.server.security.ForbiddenException;
 import org.apache.druid.sql.calcite.planner.Calcites;
 import org.apache.druid.sql.calcite.planner.DruidPlanner;
 import org.apache.druid.sql.calcite.planner.PlannerFactory;
@@ -160,6 +161,9 @@ public class SqlResource
         throw Throwables.propagate(e);
       }
     }
+    catch (ForbiddenException e) {
+      throw e; // let ForbiddenExceptionMapper handle this
+    }
     catch (Exception e) {
       log.warn(e, "Failed to handle query: %s", sqlQuery);
Unauthorized sql request should return <I> (#<I>)