Apache Superset vulnerabilities

• apache superset Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser CVE-2026-23985 Fix available 5.3 MediumJuly 30, 2026
• apache superset Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification CVE-2026-23981 Fix available 5.3 MediumJuly 30, 2026
• apache superset Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering CVE-2026-23969 Fix available 5.3 MediumFebruary 24, 2026
• apache superset Apache Superset: Improper Neutralization of Special Elements used in a SQL Command CVE-2026-23980 Public exploitFix available 5.3 MediumFebruary 24, 2026
• apache superset Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass CVE-2026-23982 Fix available 7.1 HighFebruary 24, 2026
• apache superset Apache Superset: Sensitive Data Exposure via REST API (disabled by default) CVE-2026-23983 Fix available 2.3 LowFebruary 24, 2026
• apache superset Apache Superset: SQLLab Read-Only Bypass on PostgreSQL CVE-2026-23984 Fix available 7.1 HighFebruary 24, 2026
• apache superset Apache Superset: Incorrect datasource authorization on REST API CVE-2025-55675 Fix available 5.3 MediumAugust 14, 2025
• apache superset Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions CVE-2025-55674 Fix available 5.3 MediumAugust 14, 2025
• apache superset Apache Superset: Stored XSS on charts metadata CVE-2025-55672 Fix available 5.3 MediumAugust 14, 2025
• apache superset Apache Superset: Metadata exposure in embedded charts CVE-2025-55673 Fix available 5.3 MediumAugust 14, 2025
• apache superset Apache Superset: Improper authorization bypass on row level security via SQL Injection CVE-2025-48912 Fix available 7.1 HighMay 30, 2025
• apache superset Apache Superset: Incorrect authorization leading to resource ownership takeover CVE-2025-27696 Fix available 5.3 MediumMay 13, 2025
• apache superset Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access CVE-2024-55633 Fix available 7.1 HighDecember 12, 2024
• apache superset Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled CVE-2024-53949 Fix available 7.6 HighDecember 9, 2024
• apache superset Apache Superset: Error verbosity exposes metadata in analytics databases CVE-2024-53948 Fix available 5.3 MediumDecember 9, 2024
• apache superset Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions CVE-2024-53947 Fix available 2.3 LowDecember 9, 2024
• apache superset Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions CVE-2024-39887 Fix available 4.3 MediumJuly 16, 2024
• apache superset Apache Superset: Server arbitrary file read CVE-2024-34693 Public exploitFix available 6.8 MediumJune 20, 2024
• apache superset Apache Superset: Incorrect datasource authorization on explore REST API CVE-2024-28148 Fix available 4.3 MediumMay 7, 2024
• apache superset Apache Superset: Improper authorization validation on dashboards and charts import CVE-2024-26016 Fix available 4.3 MediumFebruary 28, 2024
• apache superset Apache Superset: Improper data authorization when creating a new dataset CVE-2024-24779 Fix available 5.0 MediumFebruary 28, 2024
• apache superset Apache Superset: Improper Neutralisation of custom SQL on embedded context CVE-2024-24772 Fix available 4.3 MediumFebruary 28, 2024
• apache superset Apache Superset: Improper validation of SQL statements allows for unauthorized access to data CVE-2024-24773 Fix available 4.9 MediumFebruary 28, 2024
• apache superset Apache Superset: Improper error handling on alerts CVE-2024-27315 Fix available 4.3 MediumFebruary 28, 2024
• apache superset Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104) CVE-2024-23952 Fix available 6.5 MediumFebruary 14, 2024
• apache superset Apache Superset: Stored XSS in Dashboard Title and Chart Title CVE-2023-49657 Fix available 9.6 CriticalJanuary 23, 2024
• apache superset Apache Superset: Privilege Escalation Vulnerability CVE-2023-49734 Fix available 7.7 HighDecember 19, 2023
• apache superset Apache Superset: SQL Injection on where_in JINJA macro CVE-2023-49736 Fix available 6.5 MediumDecember 19, 2023
• apache superset Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb CVE-2023-46104 Fix available 6.5 MediumDecember 19, 2023
• apache superset Apache Superset: Lack of rate limiting allows for possible denial of service CVE-2023-42504 Fix available 5.8 MediumNovember 28, 2023
• apache superset Apache Superset: Sensitive information disclosure on db connection details CVE-2023-42505 Fix available 4.3 MediumNovember 28, 2023
• apache superset Apache Superset: Open Redirect Vulnerability CVE-2023-42502 Fix available 4.8 MediumNovember 28, 2023
• apache superset Apache Superset: Stored XSS on API endpoint CVE-2023-43701 Fix available 4.3 MediumNovember 27, 2023
• apache superset Apache Superset: Unnecessary read permissions within the Gamma role CVE-2023-42501 Fix available 4.3 MediumNovember 27, 2023
• apache superset Apache Superset: Privilege escalation with default examples database CVE-2023-40610 Fix available 6.3 MediumNovember 27, 2023
• apache superset Apache Superset: SQL parser edge case bypasses data access authorization CVE-2023-32672 Fix available 4.3 MediumSeptember 6, 2023
• apache superset Apache Superset: Metadata db write access can lead to remote code execution CVE-2023-37941 Public exploitFix available EPSS 35.5% 6.6 MediumSeptember 6, 2023
• apache superset Apache Superset: Possible Unauthorized Registration of SQLite Database Connections CVE-2023-39265 Public exploitFix available EPSS 86.0% 3.8 LowSeptember 6, 2023
• apache superset Apache Superset: Stack traces enabled by default CVE-2023-39264 Fix available 4.3 MediumSeptember 6, 2023
• apache superset Apache Superset: Improper data permission validation on Jinja templated queries CVE-2023-27523 Fix available 5.0 MediumSeptember 6, 2023
• apache superset Apache Superset: Improper API permission for low privilege users allows for SSRF CVE-2023-36388 Fix available 4.3 MediumSeptember 6, 2023
• apache superset Apache Superset: Improper Authorization check on import charts CVE-2023-27526 Fix available 4.3 MediumSeptember 6, 2023
• apache superset Apache Superset: Improper API permission for low privilege users CVE-2023-36387 Fix available 5.4 MediumSeptember 6, 2023
• apache superset Apache Superset: Database connection password leak CVE-2023-30776 Fix available 4.9 MediumApril 24, 2023
• apache superset Apache Superset: Session validation vulnerability when using provided default SECRET_KEY CVE-2023-27524 In KEVPublic exploitFix available EPSS 98.1% 8.9 HighApril 24, 2023
• apache superset Apache Superset: Possible SSRF on import datasets CVE-2023-25504 Fix available 4.9 MediumApril 17, 2023
• apache superset Apache Superset: Incorrect default permissions for Gamma role CVE-2023-27525 Fix available 3.1 LowApril 17, 2023
• apache superset Apache Superset: SQL injection vulnerability in adhoc clauses CVE-2022-41703 Fix available 5.4 MediumJanuary 16, 2023
• apache superset Apache Superset: Dashboard metadata information leak CVE-2022-45438 Fix available 5.3 MediumJanuary 16, 2023
• Show olderLoading…