CVE-2026-23984

published 2026-02-24

CVE-2026-23984: An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification…

high 7.1 CVSS 4.0

AV N AC L AT N PR L UI N VC N VI H VA N SC N SI N SA N E X CR X IR X AR X MAV X MAC X MAT X MPR X MUI X MVC X MVI X MVA X MSC X MSI X MSA X S X AU X R X V X RE X U X

An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection.
While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements.

This issue affects Apache Superset: before 6.0.0.

Users are recommended to upgrade to version 6.0.0, which fixes the issue.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
apache	superset	< 6.0.0	6.0.0
apache_software_foundation	apache_superset	>= 0.0.0 < 6.0.0	6.0.0

CWE-863 CWE-200