Skip to contentApache Software Foundation Superset vulnerabilities
- apache supersetApache Superset: Regular Expression Denial of Service (ReDoS) in SQL ParserCVE-2026-23985Fix available5.3 Medium
- apache supersetApache Superset: Improper Authorization in Chart Update allowing Dashboard ModificationCVE-2026-23981Fix available5.3 Medium
- apache supersetApache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function FilteringCVE-2026-23969Fix available5.3 Medium
- apache supersetApache Superset: Improper Neutralization of Special Elements used in a SQL CommandCVE-2026-23980Public exploitFix available5.3 Medium
- apache supersetApache Superset: Improper Authorization in Dataset Creation Allows Access Control BypassCVE-2026-23982Fix available7.1 High
- apache supersetApache Superset: Sensitive Data Exposure via REST API (disabled by default)CVE-2026-23983Fix available2.3 Low
- apache supersetApache Superset: SQLLab Read-Only Bypass on PostgreSQLCVE-2026-23984Fix available7.1 High
- apache supersetApache Superset: Incorrect datasource authorization on REST APICVE-2025-55675Fix available5.3 Medium
- apache supersetApache Superset: Improper SQL authorisation, parse not checking for specific engine functionsCVE-2025-55674Fix available5.3 Medium
- apache supersetApache Superset: Stored XSS on charts metadataCVE-2025-55672Fix available5.3 Medium
- apache supersetApache Superset: Metadata exposure in embedded chartsCVE-2025-55673Fix available5.3 Medium
- apache supersetApache Superset: Improper authorization bypass on row level security via SQL InjectionCVE-2025-48912Fix available7.1 High
- apache supersetApache Superset: Incorrect authorization leading to resource ownership takeoverCVE-2025-27696Fix available5.3 Medium
- apache supersetApache Superset: SQLLab Improper readonly query validation allows unauthorized write accessCVE-2024-55633Fix available7.1 High
- apache supersetApache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabledCVE-2024-53949Fix available7.6 High
- apache supersetApache Superset: Error verbosity exposes metadata in analytics databasesCVE-2024-53948Fix available5.3 Medium
- apache supersetApache Superset: Improper SQL authorisation, parse not checking for specific postgres functionsCVE-2024-53947Fix available2.3 Low
- apache supersetApache Superset: Improper SQL authorisation, parse not checking for specific engine functionsCVE-2024-39887Fix available4.3 Medium
- apache supersetApache Superset: Server arbitrary file readCVE-2024-34693Public exploitFix available6.8 Medium
- apache supersetApache Superset: Incorrect datasource authorization on explore REST APICVE-2024-28148Fix available4.3 Medium
- apache supersetApache Superset: Improper authorization validation on dashboards and charts importCVE-2024-26016Fix available4.3 Medium
- apache supersetApache Superset: Improper data authorization when creating a new datasetCVE-2024-24779Fix available5.0 Medium
- apache supersetApache Superset: Improper Neutralisation of custom SQL on embedded contextCVE-2024-24772Fix available4.3 Medium
- apache supersetApache Superset: Improper validation of SQL statements allows for unauthorized access to dataCVE-2024-24773Fix available4.9 Medium
- apache supersetApache Superset: Improper error handling on alertsCVE-2024-27315Fix available4.3 Medium
- apache supersetApache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104)CVE-2024-23952Fix available6.5 Medium
- apache supersetApache Superset: Stored XSS in Dashboard Title and Chart TitleCVE-2023-49657Fix available9.6 Critical
- apache supersetApache Superset: Privilege Escalation VulnerabilityCVE-2023-49734Fix available7.7 High
- apache supersetApache Superset: SQL Injection on where_in JINJA macroCVE-2023-49736Fix available6.5 Medium
- apache supersetApache Superset: Allows for uncontrolled resource consumption via a ZIP bombCVE-2023-46104Fix available6.5 Medium
- apache supersetApache Superset: Lack of rate limiting allows for possible denial of serviceCVE-2023-42504Fix available5.8 Medium
- apache supersetApache Superset: Sensitive information disclosure on db connection detailsCVE-2023-42505Fix available4.3 Medium
- apache supersetApache Superset: Open Redirect VulnerabilityCVE-2023-42502Fix available4.8 Medium
- apache supersetApache Superset: Stored XSS on API endpointCVE-2023-43701Fix available4.3 Medium
- apache supersetApache Superset: Unnecessary read permissions within the Gamma roleCVE-2023-42501Fix available4.3 Medium
- apache supersetApache Superset: Privilege escalation with default examples databaseCVE-2023-40610Fix available6.3 Medium
- apache supersetApache Superset: SQL parser edge case bypasses data access authorizationCVE-2023-32672Fix available4.3 Medium
- apache supersetApache Superset: Metadata db write access can lead to remote code executionCVE-2023-37941Public exploitFix availableEPSS 35.5%6.6 Medium
- apache supersetApache Superset: Possible Unauthorized Registration of SQLite Database ConnectionsCVE-2023-39265Public exploitFix availableEPSS 86.0%3.8 Low
- apache supersetApache Superset: Stack traces enabled by defaultCVE-2023-39264Fix available4.3 Medium
- apache supersetApache Superset: Improper data permission validation on Jinja templated queriesCVE-2023-27523Fix available5.0 Medium
- apache supersetApache Superset: Improper API permission for low privilege users allows for SSRFCVE-2023-36388Fix available4.3 Medium
- apache supersetApache Superset: Improper Authorization check on import chartsCVE-2023-27526Fix available4.3 Medium
- apache supersetApache Superset: Improper API permission for low privilege usersCVE-2023-36387Fix available5.4 Medium
- apache supersetApache Superset: Database connection password leakCVE-2023-30776Fix available4.9 Medium
- apache supersetApache Superset: Session validation vulnerability when using provided default SECRET_KEYCVE-2023-27524In KEVPublic exploitFix availableEPSS 98.1%8.9 High
- apache supersetApache Superset: Possible SSRF on import datasetsCVE-2023-25504Fix available4.9 Medium
- apache supersetApache Superset: Incorrect default permissions for Gamma roleCVE-2023-27525Fix available3.1 Low
- apache supersetApache Superset: SQL injection vulnerability in adhoc clausesCVE-2022-41703Fix available5.4 Medium
- apache supersetApache Superset: Dashboard metadata information leakCVE-2022-45438Fix available5.3 Medium
- Show olderLoading…