Apache Software Foundation Apache Superset vulnerabilities

CVE-2022-43720 [MEDIUM] CWE-74 CVE-2022-43720: An authenticated attacker with write CSS template permissions can create a record with specific HTML An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a user deletes that specific CSS template record. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVE-2023-36387 [MEDIUM] CWE-863 CVE-2023-36387: An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections.

CVE-2023-43701 [MEDIUM] CWE-79 CVE-2023-43701: Improper payload validation and an improper REST API response type, made it possible for an authenti Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache Superset versions prior to 2.1.2. Users are recommended to u

CVE-2022-43717 [MEDIUM] CWE-79 CVE-2022-43717: Dashboard rendering does not sufficiently sanitize the content of markdown components leading to pos Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVE-2022-43718 [MEDIUM] CWE-79 CVE-2022-43718: Upload data forms do not correctly render user input leading to possible XSS attack vectors that can Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVE-2022-43721 [MEDIUM] CWE-601 CVE-2022-43721: An authenticated attacker with update datasets permission could change a dataset link to an untruste An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

CVE-2023-49657 [MEDIUM] CWE-79 CVE-2023-49657: A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authent A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For 2.X versions, users should change their config to include: TALISMAN_CONFIG = { "content_sec

CVE-2023-42502 [MEDIUM] CWE-601 CVE-2023-42502: An authenticated attacker with update datasets permission could change a dataset link to an untruste An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.

CVE-2025-55672 [MEDIUM] CWE-80 CVE-2025-55672: A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. A A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hi

CVE-2024-53948 [MEDIUM] CWE-209 CVE-2024-53948: Generation of Error Message Containing analytics metadata Information in Apache Superset. This issu Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue.

CVE-2024-24772 [MEDIUM] CWE-89 CVE-2024-24772: A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error cou A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

CVE-2026-23981 [MEDIUM] CWE-285 CVE-2026-23981: An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user wit An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST API, a user can provide a list of dashboard IDs (dashboards) to associate the chart with. The validation logic in the UpdateChartComma

CVE-2023-32672 [MEDIUM] CWE-863 CVE-2023-32672: An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. Th An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query tables that they do not have proper access to within Superset. The vulnerability can be exploited by leveraging a SQL parsing vulnerability.

CVE-2024-27315 [MEDIUM] CWE-209 CVE-2024-27315: An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to gen An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Ap

CVE-2024-28148 [MEDIUM] CWE-863 CVE-2024-28148: An authenticated user could potentially access metadata for a datasource they are not authorized to An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache Superset: before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue.

CVE-2021-37839 [MEDIUM] CWE-273 CVE-2021-37839: Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related t Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata included the dataset name, columns and metrics.

CVE-2023-27526 [MEDIUM] CWE-863 CVE-2023-27526: A non Admin authenticated user could incorrectly create resources using the import charts feature, o A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0.

CVE-2023-39264 [MEDIUM] CWE-209 CVE-2023-39264: By default, stack traces for errors were enabled, which resulted in the exposure of internal traces By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.

CVE-2023-27523 [MEDIUM] CWE-863 CVE-2023-27523: Improper data authorization check on Jinja templated queries in Apache Superset up to and including Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.

CVE-2023-42501 [MEDIUM] CWE-276 CVE-2023-42501: Unnecessary read permissions within the Gamma role would allow authenticated users to read configure Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This issue affects Apache Superset: before 2.1.2. Users should upgrade to version or above 2.1.2 and run `superset init` to reconstruct the Gamma role or remove `can_read` permission from the mentioned resources.