Apache Superset vulnerabilities

CVE-2023-27524 [CRITICAL] CWE-1188 CVE-2023-27524: Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for

CVE-2023-39265 [MEDIUM] CWE-20 CVE-2023-39265: Apache Superset would allow for SQLite database connections to be incorrectly registered when an att Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is using a SQLite database for its metadata (not advised for p

CVE-2023-37941 [MEDIUM] CWE-502 CVE-2023-37941: If an attacker gains write access to the Apache Superset metadata database, they could persist a spe If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by the system administrator and the superset process itse

CVE-2018-8021 [CRITICAL] CWE-502 CVE-2018-8021: Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution. Note Superset 0.23 was released prior to any Superset release under the Apache Software Foundation.

CVE-2024-39887 [CRITICAL] CWE-89 CVE-2024-39887: An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special e An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been int

CVE-2021-44451 [MEDIUM] CWE-522 CVE-2021-44451: Apache Superset up to and including 1.3.2 allowed for registered database connections password leak Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher.

CVE-2021-27907 [MEDIUM] CWE-79 CVE-2021-27907: Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboa Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS

CVE-2023-40610 [HIGH] CWE-863 CVE-2023-40610: Improper authorization check and possible privilege escalation on Apache Superset up to but excludin Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weak

CVE-2024-53947 [CRITICAL] CVE-2024-53947: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability i Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now include

CVE-2021-28125 [MEDIUM] CWE-601 CVE-2021-28125: Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.

CVE-2020-13948 [HIGH] CVE-2020-13948: While investigating a bug report on Apache Superset, it was determined that an authenticated user co While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templated text fields in the product that would allow arbitrary access to Python’s `os` package in the web application process in versions < 0.37.1. It was thus possible for an authenticated user to list and access files, envi

CVE-2022-27479 [CRITICAL] CWE-89 CVE-2022-27479: Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should upd Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.

CVE-2021-41971 [HIGH] CWE-89 CVE-2021-41971: Apache Superset up to and including 1.3.0 when configured with ENABLE_TEMPLATE_PROCESSING on (disabl Apache Superset up to and including 1.3.0 when configured with ENABLE_TEMPLATE_PROCESSING on (disabled by default) allowed SQL injection when a malicious authenticated user sends an http request with a custom URL.

CVE-2023-49736 [HIGH] CWE-89 CVE-2023-49736: A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted stat A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the issue.

CVE-2025-27696 [HIGH] CWE-863 CVE-2025-27696: Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, ch Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.

CVE-2020-13952 [HIGH] CVE-2020-13952: In the course of work on the open source project it was discovered that authenticated users running In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a number of templated fields including the contents of query description metadata database, the hashed version of the authenticated users’ password, and access to connection informatio

CVE-2026-23980 [MEDIUM] CWE-89 CVE-2026-23980: Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which

CVE-2022-43719 [HIGH] CWE-352 CVE-2022-43719: Two legacy REST API endpoints for approval and request access are vulnerable to cross site request f Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVE-2026-23969 [MEDIUM] CWE-89 CVE-2026-23969: Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execut Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affect

CVE-2026-23982 [MEDIUM] CWE-863 CVE-2026-23982: An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks