Apache Software Foundation Apache Superset vulnerabilities

CVE-2023-27524 [CRITICAL] CWE-1188 CVE-2023-27524: Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for

CVE-2023-39265 [MEDIUM] CWE-20 CVE-2023-39265: Apache Superset would allow for SQLite database connections to be incorrectly registered when an att Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database imports. This could allow for unexpected file creation on Superset webservers. Additionally, if Apache Superset is using a SQLite database for its metadata (not advised for p

CVE-2023-37941 [MEDIUM] CWE-502 CVE-2023-37941: If an attacker gains write access to the Apache Superset metadata database, they could persist a spe If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is typically only accessible directly by the system administrator and the superset process itse

CVE-2024-39887 [CRITICAL] CWE-89 CVE-2024-39887: An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special e An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been int

CVE-2021-44451 [MEDIUM] CWE-522 CVE-2021-44451: Apache Superset up to and including 1.3.2 allowed for registered database connections password leak Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be accessed in a non-trivial way. Users should upgrade to Apache Superset 1.4.0 or higher.

CVE-2021-27907 [MEDIUM] CWE-79 CVE-2021-27907: Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboa Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information. Abusing this functionality, a malicious user could inject javascript code executing unwanted action in the context of the user's browser. The javascript code will be automatically executed (Stored XSS

CVE-2023-40610 [HIGH] CWE-863 CVE-2023-40610: Improper authorization check and possible privilege escalation on Apache Superset up to but excludin Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection that allows access to both the examples schema and Apache Superset's metadata database, an attacker using a specially crafted CTE SQL statement could change data on the metadata database. This weak

CVE-2021-28125 [MEDIUM] CWE-601 CVE-2021-28125: Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.

CVE-2022-27479 [CRITICAL] CWE-89 CVE-2022-27479: Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should upd Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.

CVE-2021-41971 [HIGH] CWE-89 CVE-2021-41971: Apache Superset up to and including 1.3.0 when configured with ENABLE_TEMPLATE_PROCESSING on (disabl Apache Superset up to and including 1.3.0 when configured with ENABLE_TEMPLATE_PROCESSING on (disabled by default) allowed SQL injection when a malicious authenticated user sends an http request with a custom URL.

CVE-2023-49736 [HIGH] CWE-89 CVE-2023-49736: A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted stat A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.2, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2, which fixes the issue.

CVE-2025-27696 [HIGH] CWE-863 CVE-2025-27696: Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, ch Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue.

CVE-2026-23980 [MEDIUM] CWE-89 CVE-2026-23980: Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which

CVE-2022-43719 [HIGH] CWE-352 CVE-2022-43719: Two legacy REST API endpoints for approval and request access are vulnerable to cross site request f Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVE-2026-23969 [MEDIUM] CWE-89 CVE-2026-23969: Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execut Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affect

CVE-2026-23982 [MEDIUM] CWE-863 CVE-2026-23982: An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks

CVE-2026-23983 [MEDIUM] CWE-200 CVE-2026-23983: A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to re A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensit

CVE-2026-23984 [MEDIUM] CWE-863 CVE-2026-23984: An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated us An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connecti

CVE-2024-55633 [MEDIUM] CWE-863 CVE-2024-55633: Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly

CVE-2025-55674 [MEDIUM] CWE-89 CVE-2025-55674: A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the executio A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database informatio