Apache Superset vulnerabilities

CVE-2022-45438 [MEDIUM] CWE-668 CVE-2022-45438: When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVE-2024-26016 [MEDIUM] CWE-863 CVE-2024-26016: A low privilege authenticated user could import an existing dashboard or chart that they do not have A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges.

CVE-2019-12413 [MEDIUM] CVE-2019-12413: In Apache Incubator Superset before 0.31 user could query database metadata information from a datab In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a specially crafted complex query.

CVE-2019-12414 [MEDIUM] CWE-200 CVE-2019-12414: In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab

CVE-2023-36387 [MEDIUM] CWE-863 CVE-2023-36387: An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.

CVE-2023-36388 [MEDIUM] CWE-918 CVE-2023-36388: Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticate Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.

CVE-2022-43720 [MEDIUM] CWE-74 CVE-2022-43720: An authenticated attacker with write CSS template permissions can create a record with specific HTML An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVE-2023-43701 [MEDIUM] CWE-79 CVE-2023-43701: Improper payload validation and an improper REST API response type, made it possible for an authenti Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache Superset versions prior to 2.1.2. Users are recommended to u

CVE-2021-32609 [MEDIUM] CWE-79 CVE-2021-32609: Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart with a malicious title, injecting html (including scripts) into the page.

CVE-2025-55672 [MEDIUM] CWE-80 CVE-2025-55672: A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. A A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hi

CVE-2022-43718 [MEDIUM] CWE-79 CVE-2022-43718: Upload data forms do not correctly render user input leading to possible XSS attack vectors that can Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVE-2022-43717 [MEDIUM] CWE-79 CVE-2022-43717: Dashboard rendering does not sufficiently sanitize the content of markdown components leading to pos Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVE-2022-43721 [MEDIUM] CWE-601 CVE-2022-43721: An authenticated attacker with update datasets permission could change a dataset link to an untruste An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVE-2023-49657 [MEDIUM] CWE-79 CVE-2023-49657: A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authent A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For 2.X versions, users should change their config to include: TALISMAN_CONFIG = { "content_sec

CVE-2023-42502 [MEDIUM] CWE-601 CVE-2023-42502: An authenticated attacker with update datasets permission could change a dataset link to an untruste An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.

CVE-2024-53948 [MEDIUM] CWE-209 CVE-2024-53948: Generation of Error Message Containing analytics metadata Information in Apache Superset. This issu Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue.

CVE-2024-24772 [MEDIUM] CWE-89 CVE-2024-24772: A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error cou A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

CVE-2024-27315 [MEDIUM] CWE-209 CVE-2024-27315: An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to gen An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Ap

CVE-2023-32672 [MEDIUM] CWE-863 CVE-2023-32672: An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. Th An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.

CVE-2024-28148 [MEDIUM] CWE-863 CVE-2024-28148: An authenticated user could potentially access metadata for a datasource they are not authorized to An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache Superset: before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue.