Every CVE Search/ Get API key

CVE-2023-27524

Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

8.9 HighIn KEVPublic exploitFix available

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.

All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your superset_config.py file like:

SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>

Alternatively you can set it with SUPERSET_SECRET_KEY environment variable.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
Low

Exploit likelihood

98.1%Up 98.1 points since Apr 25, 2023
90%50%10%1%

What each source reports

CVE List Score used 8.9

Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.

All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your superset_config.py file like:

SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>

Alternatively you can set it with SUPERSET_SECRET_KEY environment variable.

Record
CVE-2023-27524
CVSS 3.1
8.9 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-1188
Updated
2026-11-02
EUVDEUVD-2023-1207 8.9

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.

All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your superset_config.py file like:

SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>

Alternatively you can set it with SUPERSET_SECRET_KEY environment variable.

Record
EUVD-2023-1207
CVSS 3.1
8.9 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Updated
2026-11-02
GitHub AdvisoriesGHSA-5cx2-vq3h-x52c 8.9

Apache superset missing check for default SECRET_KEY

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.

Record
GHSA-5cx2-vq3h-x52c
CVSS 3.1
8.9 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L/E:H
Weakness
CWE-1188
Updated
2026-11-02
CISA KEV No score

Apache Superset Insecure Default Initialization of Resource Vulnerability

Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.

Record
CVE-2023-27524
Weakness
CWE-1188
Updated
2026-11-02
NVD 8.9

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.

All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your superset_config.py file like:

SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>

Alternatively you can set it with SUPERSET_SECRET_KEY environment variable.

Record
CVE-2023-27524
CVSS 3.1
8.9 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS 3.1
9.8 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-1188
Updated
2026-11-02
OSV 8.9

Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.

All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your superset_config.py file like:

SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>

Alternatively you can set it with SUPERSET_SECRET_KEY environment variable.

Record
CVE-2023-27524
CVSS 3.1
8.9 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
Weakness
CWE-1188
Updated
2026-11-02
OSVGHSA-5cx2-vq3h-x52c 8.9

Apache superset missing check for default SECRET_KEY

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.

Record
GHSA-5cx2-vq3h-x52c
CVSS 3.1
8.9 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L/E:H
Weakness
CWE-1188
Updated
2026-11-02
OSVPYSEC-2026-1161 8.9

Apache superset missing check for default SECRET_KEY

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.

Record
PYSEC-2026-1161
CVSS 3.1
8.9 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L/E:H
Updated
2026-11-02
OSVBIT-superset-2023-27524 No score

Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.

All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your superset_config.py file like:

SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>

Alternatively you can set it with SUPERSET_SECRET_KEY environment variable.

Record
BIT-superset-2023-27524
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
apache-superset
PyPI
 before 2.1.0
2.1.0
superset
Bitnami
 before 2.0.2
2.0.2
apache-superset
PyPI
 before 2.1.0, plus listed versions
0.34.00.34.10.35.10.35.20.36.0
Show 21 moreShow less
0.37.00.37.10.37.20.38.00.38.11.0.01.0.11.1.01.2.01.3.01.3.11.3.21.4.01.4.11.4.21.5.01.5.11.5.21.5.32.0.02.0.1
2.1.0

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubhorizon3ai/CVE-2023-275242023-04-25
PoC in GitHubOkaytc/Superset_auth_bypass_check2023-04-27
PoC in GitHubZZ-SOCMAP/CVE-2023-275242023-04-27
PoC in GitHubAp0dexMe0/CVE-2023-275242023-05-04
PoC in GitHubMaanVader/CVE-2023-27524-POC2023-05-04
PoC in GitHubtardc/CVE-2023-275242023-05-08
Exploit-DBApache Superset 2.0.0 - Authentication Bypass2023-05-23
PoC in GitHubnecroteddy/CVE-2023-275242023-08-30
MetasploitApache Superset Signed Cookie RCE2023-09-06
PoC in GitHubjakabakos/CVE-2023-27524-Apache-Superset-Auth-Bypass-and-RCE2023-09-08
Show 10 moreShow less
Public exploits
SourceLinkDate
PoC in GitHubCN016/Apache-Superset-SECRET_KEY-CVE-2023-27524-2023-10-10
PoC in GitHubh1n4mx0z/Research-CVE-2023-275242023-10-30
PoC in GitHubCappricio-Securities/CVE-2023-275242024-05-11
PoC in GitHubkarthi-the-hacker/CVE-2023-275242024-05-11
PoC in GitHubsumaiyafathima-code/CVE-2023-275242026-03-15
PoC in GitHubrachidafaf/bola-CVE-2023-275242026-04-05
PoC in GitHubCyberCTF/vulhub-superset-cve-2023-275242026-10-08
PoC in GitHubsifatnotes/secbyte-cve-exploitation-real-world-vulnerabilities-red-teaming-ctf-labs2026-10-29
MetasploitApache Superset Signed Cookie Priv Esc2023-04-25
NucleiApache Superset - Authentication Bypass

History

History
RecordedChangedSources
exploitation, exploits
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, Metasploit, Nuclei, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2023-27524 is a high vulnerability (CVSS 8.9) in Apache Superset, published April 24, 2023. CISA lists it as known to be exploited, since January 8, 2024. EUVD reports exploitation since January 8, 2024. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 98.1%, the 99th percentile. Fixed in apache-superset 2.1.0.

References

Show 5 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open