CVE-2023-39264
Apache Superset: Stack traces enabled by default
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
Apache Superset: Stack traces enabled by default
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
- Record
CVE-2023-39264- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
EUVDEUVD-2023-2490
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
- Record
EUVD-2023-2490- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cpvx-2365-466c
Apache Superset may expose internal traces on REST API endpoints
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
- Record
GHSA-cpvx-2365-466c- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
NVD
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
- Record
CVE-2023-39264- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
OSV
Apache Superset: Stack traces enabled by default
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
- Record
CVE-2023-39264- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
OSVGHSA-cpvx-2365-466c
Apache Superset may expose internal traces on REST API endpoints
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
- Record
GHSA-cpvx-2365-466c- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-209
- Updated
- 2026-11-02
OSVPYSEC-2026-1172
Apache Superset may expose internal traces on REST API endpoints
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
- Record
PYSEC-2026-1172- CVSS 3.1
- 4.3 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVBIT-superset-2023-39264 No score
Apache Superset: Stack traces enabled by default
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
- Record
BIT-superset-2023-39264- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
apache-supersetPyPI |
through 2.1.0 | None known |
supersetBitnami |
before 2.1.1 | 2.1.1 |
apache-supersetPyPI |
through 2.1.0, plus listed versions 0.34.00.34.10.35.10.35.20.36.0 Show 21 moreShow less0.37.00.37.10.37.20.38.00.38.11.0.01.0.11.1.01.2.01.3.01.3.11.3.21.4.01.4.11.4.21.5.01.5.11.5.21.5.32.0.02.0.1 |
None known |
apache-supersetPyPI |
before 2.1.1, plus listed versions 0.34.00.34.10.35.10.35.20.36.0 Show 25 moreShow less0.37.00.37.10.37.20.38.00.38.11.0.01.0.11.1.01.2.01.3.01.3.11.3.21.4.01.4.11.4.21.5.01.5.11.5.21.5.32.0.02.0.12.1.02.1.1rc12.1.1rc22.1.1rc3 |
2.1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-39264 is a medium vulnerability (CVSS 4.3) in Apache Superset, published September 6, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.13%, the 66th percentile. Fixed in superset 2.1.1.