{"id":"CVE-2023-27524","aliases":["BIT-superset-2023-27524","EUVD-2023-1207","GHSA-5cx2-vq3h-x52c","PYSEC-2026-1161"],"status":"published","title":"Apache Superset: Session validation vulnerability when using provided default SECRET_KEY","description":"Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.\n\nAll superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database.\nAdd a strong SECRET_KEY to your `superset_config.py` file like:\n\nSECRET_KEY = \u003cYOUR_OWN_RANDOM_GENERATED_SECRET_KEY\u003e\n\nAlternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.","severity":{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.98148,"percentile":0.99913,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":true},"cwes":["CWE-1188"],"published":"2023-04-24T15:28:16Z","modified":"2026-10-28T02:30:40Z","kev":{"date_added":"2024-01-08","due_date":"2024-01-29","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2024-01-08"},{"source":"kev","since":"2024-01-08"}],"exploits":[{"source":"pocgithub","id":"horizon3ai/CVE-2023-27524","title":"horizon3ai/CVE-2023-27524","date":"2023-04-25","url":"https://github.com/horizon3ai/CVE-2023-27524"},{"source":"pocgithub","id":"Okaytc/Superset_auth_bypass_check","title":"Okaytc/Superset_auth_bypass_check","date":"2023-04-27","url":"https://github.com/Okaytc/Superset_auth_bypass_check"},{"source":"pocgithub","id":"ZZ-SOCMAP/CVE-2023-27524","title":"ZZ-SOCMAP/CVE-2023-27524","date":"2023-04-27","url":"https://github.com/ZZ-SOCMAP/CVE-2023-27524"},{"source":"pocgithub","id":"Ap0dexMe0/CVE-2023-27524","title":"Ap0dexMe0/CVE-2023-27524","date":"2023-05-04","url":"https://github.com/Ap0dexMe0/CVE-2023-27524"},{"source":"pocgithub","id":"MaanVader/CVE-2023-27524-POC","title":"MaanVader/CVE-2023-27524-POC","date":"2023-05-04","url":"https://github.com/MaanVader/CVE-2023-27524-POC"},{"source":"pocgithub","id":"tardc/CVE-2023-27524","title":"tardc/CVE-2023-27524","date":"2023-05-08","url":"https://github.com/tardc/CVE-2023-27524"},{"source":"exploitdb","id":"EDB-51447","title":"Apache Superset 2.0.0 - Authentication Bypass","type":"webapps","platform":"multiple","date":"2023-05-23","url":"https://www.exploit-db.com/exploits/51447"},{"source":"pocgithub","id":"necroteddy/CVE-2023-27524","title":"necroteddy/CVE-2023-27524","date":"2023-08-30","url":"https://github.com/necroteddy/CVE-2023-27524"},{"source":"metasploit","id":"exploit/linux/http/apache_superset_cookie_sig_rce","title":"Apache Superset Signed Cookie RCE","type":"exploit","platform":"Python","date":"2023-09-06","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/apache_superset_cookie_sig_rce"},{"source":"pocgithub","id":"jakabakos/CVE-2023-27524-Apache-Superset-Auth-Bypass-and-RCE","title":"jakabakos/CVE-2023-27524-Apache-Superset-Auth-Bypass-and-RCE","date":"2023-09-08","url":"https://github.com/jakabakos/CVE-2023-27524-Apache-Superset-Auth-Bypass-and-RCE"},{"source":"pocgithub","id":"CN016/Apache-Superset-SECRET_KEY-CVE-2023-27524-","title":"CN016/Apache-Superset-SECRET_KEY-CVE-2023-27524-","date":"2023-10-10","url":"https://github.com/CN016/Apache-Superset-SECRET_KEY-CVE-2023-27524-"},{"source":"pocgithub","id":"h1n4mx0z/Research-CVE-2023-27524","title":"h1n4mx0z/Research-CVE-2023-27524","date":"2023-10-30","url":"https://github.com/h1n4mx0z/Research-CVE-2023-27524"},{"source":"pocgithub","id":"Cappricio-Securities/CVE-2023-27524","title":"Cappricio-Securities/CVE-2023-27524","date":"2024-05-11","url":"https://github.com/Cappricio-Securities/CVE-2023-27524"},{"source":"pocgithub","id":"karthi-the-hacker/CVE-2023-27524","title":"karthi-the-hacker/CVE-2023-27524","date":"2024-05-11","url":"https://github.com/karthi-the-hacker/CVE-2023-27524"},{"source":"pocgithub","id":"sumaiyafathima-code/CVE-2023-27524","title":"sumaiyafathima-code/CVE-2023-27524","date":"2026-03-15","url":"https://github.com/sumaiyafathima-code/CVE-2023-27524"},{"source":"pocgithub","id":"rachidafaf/bola-CVE-2023-27524","title":"rachidafaf/bola-CVE-2023-27524","date":"2026-04-05","url":"https://github.com/rachidafaf/bola-CVE-2023-27524"},{"source":"pocgithub","id":"CyberCTF/vulhub-superset-cve-2023-27524","title":"CyberCTF/vulhub-superset-cve-2023-27524","date":"2026-10-08","url":"https://github.com/CyberCTF/vulhub-superset-cve-2023-27524"},{"source":"pocgithub","id":"sifatnotes/secbyte-cve-exploitation-real-world-vulnerabilities-red-teaming-ctf-labs","title":"sifatnotes/secbyte-cve-exploitation-real-world-vulnerabilities-red-teaming-ctf-labs","date":"2026-10-29","url":"https://github.com/sifatnotes/secbyte-cve-exploitation-real-world-vulnerabilities-red-teaming-ctf-labs"},{"source":"metasploit","id":"auxiliary/gather/apache_superset_cookie_sig_priv_esc","title":"Apache Superset Signed Cookie Priv Esc","type":"auxiliary","date":"2023-04-25","verified":true,"url":"https://www.rapid7.com/db/modules/auxiliary/gather/apache_superset_cookie_sig_priv_esc"},{"source":"nuclei","id":"CVE-2023-27524","title":"Apache Superset - Authentication Bypass","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2023/CVE-2023-27524.yaml"}],"fixes":[{"ecosystem":"PyPI","package":"apache-superset","fixed_in":["2.1.0"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"superset","fixed_in":["2.0.2"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"apache-superset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"superset","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.2"}]}]},{"source":"osv","ecosystem":"PyPI","package":"apache-superset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0"}]}],"versions":["0.34.0","0.34.1","0.35.1","0.35.2","0.36.0","0.37.0","0.37.1","0.37.2","0.38.0","0.38.1","1.0.0","1.0.1","1.1.0","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","1.4.1","1.4.2","1.5.0","1.5.1","1.5.2","1.5.3","2.0.0","2.0.1"]},{"source":"osv","ecosystem":"PyPI","package":"apache-superset","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0"}]}],"versions":["0.34.0","0.34.1","0.35.1","0.35.2","0.36.0","0.37.0","0.37.1","0.37.2","0.38.0","0.38.1","1.0.0","1.0.1","1.1.0","1.2.0","1.3.0","1.3.1","1.3.2","1.4.0","1.4.1","1.4.2","1.5.0","1.5.1","1.5.2","1.5.3","2.0.0","2.0.1"]}],"products":[{"vendor":"apache","product":"superset"},{"vendor":"apache software foundation","product":"apache superset"}],"references":[{"url":"https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk","tags":["vendor-advisory","x_transferred","Mailing List","Vendor Advisory","advisory","web"]},{"url":"https://www.openwall.com/lists/oss-security/2023/04/24/2","tags":["x_transferred","Mailing List","discussion","web"]},{"url":"https://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","advisory","web"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27524","tags":["government-resource","Third Party Advisory","US Government Resource","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-27524","tags":["web","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2023/04/24/2","tags":["web"]},{"url":"https://github.com/apache/superset/commit/b180319bbf08e876ea84963220ebebbfd0699e03","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5cx2-vq3h-x52c","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27524.json","tags":["advisory"]},{"url":"https://github.com/apache/superset","tags":["package"]},{"url":"https://pypi.org/project/apache-superset","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-27524","title":"Apache Superset: Session validation vulnerability when using provided default SECRET_KEY","description":"Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.\n\nAll superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database.\nAdd a strong SECRET_KEY to your `superset_config.py` file like:\n\nSECRET_KEY = \u003cYOUR_OWN_RANDOM_GENERATED_SECRET_KEY\u003e\n\nAlternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.","status":"published","published":"2023-04-24T15:28:16.573Z","modified":"2025-10-21T23:05:48.552Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:35:26.261013Z"}],"euvd":[{"id":"EUVD-2023-1207","description":"Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.\n\nAll superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database.\nAdd a strong SECRET_KEY to your `superset_config.py` file like:\n\nSECRET_KEY = \u003cYOUR_OWN_RANDOM_GENERATED_SECRET_KEY\u003e\n\nAlternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.","status":"published","published":"2023-04-24T15:28:16Z","modified":"2025-10-21T23:05:48Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"exploited_since":"2024-01-08","updated_at":"2026-11-02T20:31:27.312976Z"}],"ghsa":[{"id":"GHSA-5cx2-vq3h-x52c","title":"Apache superset missing check for default SECRET_KEY","description":"Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.","status":"published","published":"2023-04-24T18:30:30Z","modified":"2025-10-22T19:20:32Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L/E:H","level":"high"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:39:02.474737Z"}],"kev":[{"id":"CVE-2023-27524","title":"Apache Superset Insecure Default Initialization of Resource Vulnerability","description":"Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.","cwes":["CWE-1188"],"kev":{"date_added":"2024-01-08","due_date":"2024-01-29","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2023-27524","description":"Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.\n\nAll superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database.\nAdd a strong SECRET_KEY to your `superset_config.py` file like:\n\nSECRET_KEY = \u003cYOUR_OWN_RANDOM_GENERATED_SECRET_KEY\u003e\n\nAlternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.","status":"published","published":"2023-04-24T16:15:07.843Z","modified":"2026-06-17T05:45:23.917Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T14:07:56.683259Z"}],"osv":[{"id":"CVE-2023-27524","title":"Apache Superset: Session validation vulnerability when using provided default SECRET_KEY","description":"Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.\n\nAll superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database.\nAdd a strong SECRET_KEY to your `superset_config.py` file like:\n\nSECRET_KEY = \u003cYOUR_OWN_RANDOM_GENERATED_SECRET_KEY\u003e\n\nAlternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.","status":"published","published":"2023-04-24T15:28:16.573Z","modified":"2026-10-28T02:30:40.185557748Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L","level":"high"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T15:44:31.135751Z"},{"id":"GHSA-5cx2-vq3h-x52c","title":"Apache superset missing check for default SECRET_KEY","description":"Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.","status":"published","published":"2023-04-24T18:30:30Z","modified":"2026-07-07T17:56:24.545479431Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L/E:H","level":"high"}],"cwes":["CWE-1188"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"PYSEC-2026-1161","title":"Apache superset missing check for default SECRET_KEY","description":"Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.","status":"published","published":"2026-07-07T11:45:18.61561Z","modified":"2026-07-07T17:56:24.545479431Z","cvss":[{"version":"3.1","score":8.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L/E:H","level":"high"}],"updated_at":"2026-11-02T15:52:54.622769Z"},{"id":"BIT-superset-2023-27524","title":"Apache Superset: Session validation vulnerability when using provided default SECRET_KEY","description":"Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.\n\nAll superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database.\nAdd a strong SECRET_KEY to your `superset_config.py` file like:\n\nSECRET_KEY = \u003cYOUR_OWN_RANDOM_GENERATED_SECRET_KEY\u003e\n\nAlternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.","status":"published","published":"2025-02-05T07:28:32.393Z","modified":"2026-09-08T08:45:15.725019462Z","updated_at":"2026-11-02T15:28:35.51001Z"}]}}