Apache Superset (Apache Software Foundation) - vulnerabilities (CVEs)

65 CVEs, 0 in the last 30 days, 6 known versions, newest CVE from 2026-07-30. Vendor: Apache Software Foundation.

CVEs of Apache Superset

CVE-2026-23985 - CVSS 6.5 (medium), 2026-07-30: A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the…
CVE-2026-23981 - CVSS 5.3 (medium), 2026-07-30: An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they…
CVE-2026-23984 - CVSS 7.1 (high), 2026-02-24: An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification…
CVE-2026-23983 - CVSS 6.5 (medium), 2026-02-24: A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint…
CVE-2026-23980 - CVSS 6.5 (medium), 2026-02-24: Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read…
CVE-2026-23969 - CVSS 6.5 (medium), 2026-02-24: Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab…
CVE-2026-23982 - CVSS 7.1 (high), 2026-02-24: An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset,…
CVE-2025-55673 - CVSS 5.3 (medium), 2025-08-14: When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field…
CVE-2025-55672 - CVSS 5.4 (medium), 2025-08-14: A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can…
CVE-2025-55675 - CVSS 6.5 (medium), 2025-08-14: Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to…
CVE-2025-55674 - CVSS 6.5 (medium), 2025-08-14: A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special…
CVE-2025-48912 - CVSS 7.1 (high), 2025-05-30: An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields.…
CVE-2025-27696 - CVSS 8.8 (high), 2025-05-13: Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read…
CVE-2024-55633 - CVSS 7.1 (high), 2024-12-12: Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML…
CVE-2024-53948 - CVSS 5.3 (medium), 2024-12-09: Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are…
CVE-2024-53947 - CVSS 9.8 (critical), 2024-12-09: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific…
CVE-2024-53949 - CVSS 7.6 (high), 2024-12-09: Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use…
CVE-2024-39887 - CVSS 9.8 (critical), 2024-07-16: An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain…
CVE-2024-34693 - CVSS 6.8 (medium), 2024-06-20: Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If…
CVE-2024-28148 - CVSS 4.3 (medium), 2024-05-07: An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue…
CVE-2024-24779 - CVSS 6.5 (medium), 2024-02-28: Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create virtual datasets to…
CVE-2024-24773 - CVSS 6.5 (medium), 2024-02-28: Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache…
CVE-2024-24772 - CVSS 4.3 (medium), 2024-02-28: A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics…
CVE-2024-26016 - CVSS 5.4 (medium), 2024-02-28: A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining…
CVE-2024-27315 - CVSS 4.3 (medium), 2024-02-28: An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an…
CVE-2024-23952 - CVSS 6.5 (medium), 2024-02-14: This is a duplicate for CVE-2023-46104. With correct CVE version ranges for affected Apache Superset. Uncontrolled resource consumption can be triggered by…
CVE-2023-49657 - CVSS 9.6 (critical), 2024-01-23: A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts…
CVE-2023-49734 - CVSS 7.7 (high), 2023-12-19: An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts…
CVE-2023-49736 - CVSS 8.8 (high), 2023-12-19: A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache…
CVE-2023-46104 - CVSS 6.5 (medium), 2023-12-19: Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This…
CVE-2023-42504 - CVSS 6.5 (medium), 2023-11-28: An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of…
CVE-2023-42505 - CVSS 4.3 (medium), 2023-11-28: An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username.…
CVE-2023-42502 - CVSS 5.4 (medium), 2023-11-28: An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be…
CVE-2023-42501 - CVSS 4.3 (medium), 2023-11-27: Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations. This issue affects Apache…
CVE-2023-40610 - CVSS 8.8 (high), 2023-11-27: Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Using the default examples database connection…
CVE-2023-43701 - CVSS 5.4 (medium), 2023-11-27: Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's…
CVE-2023-37941 - CVSS 6.6 (medium), 2023-09-06: If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote…
CVE-2023-32672 - CVSS 4.3 (medium), 2023-09-06: An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated user to query…
CVE-2023-39265 - CVSS 6.5 (medium), 2023-09-06: Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite…
CVE-2023-36387 - CVSS 5.4 (medium), 2023-09-06: An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database…
CVE-2023-27526 - CVSS 4.3 (medium), 2023-09-06: A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.1.0.
CVE-2023-39264 - CVSS 4.3 (medium), 2023-09-06: By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists…
CVE-2023-27523 - CVSS 5 (medium), 2023-09-06: Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on…
CVE-2023-36388 - CVSS 5.4 (medium), 2023-09-06: Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.
CVE-2023-30776 - CVSS 6.5 (medium), 2023-04-24: An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects…
CVE-2023-27524 - CVSS 9.8 (critical), 2023-04-24: Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY…
CVE-2023-25504 - CVSS 6.5 (medium), 2023-04-17: A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct…
CVE-2023-27525 - CVSS 4.3 (medium), 2023-04-17: An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset up to and including…
CVE-2022-43717 - CVSS 5.4 (medium), 2023-01-16: Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by…
CVE-2022-43720 - CVSS 5.4 (medium), 2023-01-16: An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast…
CVE-2022-41703 - CVSS 5.4 (medium), 2023-01-16: A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the…
CVE-2022-43719 - CVSS 8.8 (high), 2023-01-16: Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue affects Apache Superset version 1.5.2…
CVE-2022-45438 - CVSS 5.3 (medium), 2023-01-16: When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard…
CVE-2022-43718 - CVSS 5.4 (medium), 2023-01-16: Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database…
CVE-2022-43721 - CVSS 5.4 (medium), 2023-01-16: An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when…
CVE-2021-37839 - CVSS 4.3 (medium), 2022-07-06: Apache Superset up to 1.5.1 allowed for authenticated users to access metadata information related to datasets they have no permission on. This metadata…
CVE-2022-27479 - CVSS 9.8 (critical), 2022-04-13: Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or higher which addresses this issue.
CVE-2021-44451 - CVSS 6.5 (medium), 2022-02-01: Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. This information could be…
CVE-2021-42250 - CVSS 6.5 (medium), 2021-11-17: Improper output neutralization for Logs. A specific Apache Superset HTTP endpoint allowed for an authenticated user to forge log entries or inject malicious…
CVE-2021-41972 - CVSS 6.5 (medium), 2021-11-12: Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users. This information could be accessed in a…
CVE-2021-41971 - CVSS 8.8 (high), 2021-10-18: Apache Superset up to and including 1.3.0 when configured with ENABLE_TEMPLATE_PROCESSING on (disabled by default) allowed SQL injection when a malicious…
CVE-2021-32609 - CVSS 5.4 (medium), 2021-10-18: Apache Superset up to and including 1.1 does not sanitize titles correctly on the Explore page. This allows an attacker with Explore access to save a chart…
CVE-2021-28125 - CVSS 6.1 (medium), 2021-04-27: Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects…
CVE-2021-27907 - CVSS 5.4 (medium), 2021-03-05: Apache Superset up to and including 0.38.0 allowed the creation of a Markdown component on a Dashboard page for describing chart's related information.…
CVE-2020-1932 - CVSS 6.5 (medium), 2020-01-28: An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1. Authenticated Apache Superset users are able to retrieve…