apache-superset
A modern, enterprise-ready business intelligence web application
Activity
- Latest release
- 4mo ago
- Total releases
- 83
- Cadence
- ~13 days
- Last 12 months
- 8
Details
- License
- custom
- First release
- Sep 18, 2019
| Version | Released | |
|---|---|---|
6.1.0
minor
|
6.1.0
minor
Dependencies (156)
+ 148 more |
|
6.1.0rc3
pre
|
6.1.0rc3
pre
Dependencies (156)
+ 148 more |
|
6.1.0rc2
pre
|
6.1.0rc2
pre
Dependencies (156)
+ 148 more |
|
6.1.0rc1
pre
|
6.1.0rc1
pre
Dependencies (156)
+ 148 more |
|
6.0.1rc1
pre
|
6.0.1rc1
pre
|
|
6.0.0
major
|
6.0.0
major
|
|
6.0.0rc4
pre
4 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev |
6.0.0rc4
pre
|
|
6.0.0rc3
pre
4 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev |
6.0.0rc3
pre
|
|
6.0.0rc2
pre
4 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev |
6.0.0rc2
pre
|
|
4.1.4
patch
7 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev |
4.1.4
patch
|
|
4.1.4rc1
pre
7 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev |
4.1.4rc1
pre
|
|
6.0.0rc1
pre
4 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev |
6.0.0rc1
pre
|
|
4.1.3.post1
pre
7 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev |
4.1.3.post1
pre
Dependencies (140)
+ 132 more |
|
4.1.3rc2
pre
8 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev |
4.1.3rc2
pre
Dependencies (140)
+ 132 more |
|
5.0.0
major
4 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev |
5.0.0
major
Dependencies (140)
+ 132 more |
|
5.0.0rc4
pre
7 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev |
5.0.0rc4
pre
|
|
5.0.0rc3
pre
7 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev |
5.0.0rc3
pre
|
|
4.1.3rc1
pre
8 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev |
4.1.3rc1
pre
|
|
5.0.0rc2
pre
7 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev |
5.0.0rc2
pre
|
|
4.1.2
patch
8 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev |
4.1.2
patch
|
|
4.1.2rc1
pre
11 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev |
4.1.2rc1
pre
|
|
5.0.0rc1
pre
7 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev |
5.0.0rc1
pre
|
|
4.1.1
patch
11 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev |
4.1.1
patch
|
|
4.1.1rc1
pre
11 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev |
4.1.1rc1
pre
|
|
4.1.0
minor
11 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev |
4.1.0
minor
|
|
4.1.0rc4
pre
15 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev |
4.1.0rc4
pre
|
|
4.1.0rc3
pre
15 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev |
4.1.0rc3
pre
|
|
4.1.0rc2
pre
15 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev |
4.1.0rc2
pre
|
|
4.0.2
patch
15 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev |
4.0.2
patch
|
|
4.0.1
patch
16 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev |
4.0.1
patch
|
|
3.1.3
patch
16 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev |
3.1.3
patch
|
|
4.0.0
major
17 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-34693
PYSEC-2026-1183
BIT-superset-2024-34693
GHSA-hcr7-cqwc-q5gq
Jul 07, 2026
Apache Superset server arbitrary file read
Low
Network
Low
High
None
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table. This issue affects Apache Superset before version 3.1.3 and in version 4.0.0. Users are recommended to upgrade to version 4.0.1 or 3.1.3, both of which fix the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 38 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
4.0.0
Fixed in
3.1.3
4.0.1
References Updated Jul 07, 2026 · Source: OSV.dev |
4.0.0
major
|
|
3.1.2
patch
17 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-34693
PYSEC-2026-1183
BIT-superset-2024-34693
GHSA-hcr7-cqwc-q5gq
Jul 07, 2026
Apache Superset server arbitrary file read
Low
Network
Low
High
None
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table. This issue affects Apache Superset before version 3.1.3 and in version 4.0.0. Users are recommended to upgrade to version 4.0.1 or 3.1.3, both of which fix the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 38 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
4.0.0
Fixed in
3.1.3
4.0.1
References Updated Jul 07, 2026 · Source: OSV.dev |
3.1.2
patch
|
|
4.0.0rc2
pre
16 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev |
4.0.0rc2
pre
|
|
4.0.0rc1
pre
16 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev |
4.0.0rc1
pre
|
|
3.1.1
patch
18 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-34693
PYSEC-2026-1183
BIT-superset-2024-34693
GHSA-hcr7-cqwc-q5gq
Jul 07, 2026
Apache Superset server arbitrary file read
Low
Network
Low
High
None
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table. This issue affects Apache Superset before version 3.1.3 and in version 4.0.0. Users are recommended to upgrade to version 4.0.1 or 3.1.3, both of which fix the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 38 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
4.0.0
Fixed in
3.1.3
4.0.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-28148
PYSEC-2026-1153
BIT-superset-2024-28148
GHSA-299q-3p96-5898
Jul 07, 2026
Apache Superset Incorrect Authorization vulnerability
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 36 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
Fixed in
3.1.2
References Updated Jul 07, 2026 · Source: OSV.dev |
3.1.1
patch
|
|
3.0.4
patch
19 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-34693
PYSEC-2026-1183
BIT-superset-2024-34693
GHSA-hcr7-cqwc-q5gq
Jul 07, 2026
Apache Superset server arbitrary file read
Low
Network
Low
High
None
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table. This issue affects Apache Superset before version 3.1.3 and in version 4.0.0. Users are recommended to upgrade to version 4.0.1 or 3.1.3, both of which fix the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 38 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
4.0.0
Fixed in
3.1.3
4.0.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-28148
PYSEC-2026-1153
BIT-superset-2024-28148
GHSA-299q-3p96-5898
Jul 07, 2026
Apache Superset Incorrect Authorization vulnerability
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 36 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
Fixed in
3.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-46104
PYSEC-2026-1167
BIT-superset-2023-46104
GHSA-95mg-jgfx-54v9
Jul 07, 2026
Apache Superset uncontrolled resource consumption
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 24 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
Fixed in
2.1.2
3.1.0rc1
References
Updated Jul 07, 2026 · Source: OSV.dev |
3.0.4
patch
|
|
3.1.0
minor
23 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-34693
PYSEC-2026-1183
BIT-superset-2024-34693
GHSA-hcr7-cqwc-q5gq
Jul 07, 2026
Apache Superset server arbitrary file read
Low
Network
Low
High
None
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table. This issue affects Apache Superset before version 3.1.3 and in version 4.0.0. Users are recommended to upgrade to version 4.0.1 or 3.1.3, both of which fix the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 38 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
4.0.0
Fixed in
3.1.3
4.0.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-28148
PYSEC-2026-1153
BIT-superset-2024-28148
GHSA-299q-3p96-5898
Jul 07, 2026
Apache Superset Incorrect Authorization vulnerability
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 36 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
Fixed in
3.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-26016
PYSEC-2026-1158
BIT-superset-2024-26016
GHSA-3v9r-885j-762g
Jul 07, 2026
Apache Superset: Improper authorization validation on dashboards and charts import
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.Users are recommended to upgrade to version 3.1.1, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24779
PYSEC-2026-1191
BIT-superset-2024-24779
GHSA-wr6g-9wcr-cmqj
Jul 07, 2026
Apache Superset: Improper data authorization when creating a new dataset
5.0
/ 10
Medium
Network
Low
Low
None
Changed
Low
None
None
Apache Superset with custom roles that include Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24773
PYSEC-2026-1160
BIT-superset-2024-24773
GHSA-5474-f7g5-273q
Jul 07, 2026
Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24772
PYSEC-2026-1185
BIT-superset-2024-24772
GHSA-m6jm-3v38-76j4
Jul 07, 2026
Apache Superset: Improper Neutralization of custom SQL on embedded context
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-27315
PYSEC-2026-1181
BIT-superset-2024-27315
GHSA-h7r6-8qmm-hj5r
Jul 07, 2026
Apache Superset: Improper error handling on alerts
Medium
Network
Low
Low
None
An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev |
3.1.0
minor
|
|
3.0.3
patch
24 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-34693
PYSEC-2026-1183
BIT-superset-2024-34693
GHSA-hcr7-cqwc-q5gq
Jul 07, 2026
Apache Superset server arbitrary file read
Low
Network
Low
High
None
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table. This issue affects Apache Superset before version 3.1.3 and in version 4.0.0. Users are recommended to upgrade to version 4.0.1 or 3.1.3, both of which fix the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 38 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
4.0.0
Fixed in
3.1.3
4.0.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-28148
PYSEC-2026-1153
BIT-superset-2024-28148
GHSA-299q-3p96-5898
Jul 07, 2026
Apache Superset Incorrect Authorization vulnerability
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 36 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
Fixed in
3.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-26016
PYSEC-2026-1158
BIT-superset-2024-26016
GHSA-3v9r-885j-762g
Jul 07, 2026
Apache Superset: Improper authorization validation on dashboards and charts import
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.Users are recommended to upgrade to version 3.1.1, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24779
PYSEC-2026-1191
BIT-superset-2024-24779
GHSA-wr6g-9wcr-cmqj
Jul 07, 2026
Apache Superset: Improper data authorization when creating a new dataset
5.0
/ 10
Medium
Network
Low
Low
None
Changed
Low
None
None
Apache Superset with custom roles that include Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24773
PYSEC-2026-1160
BIT-superset-2024-24773
GHSA-5474-f7g5-273q
Jul 07, 2026
Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24772
PYSEC-2026-1185
BIT-superset-2024-24772
GHSA-m6jm-3v38-76j4
Jul 07, 2026
Apache Superset: Improper Neutralization of custom SQL on embedded context
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-27315
PYSEC-2026-1181
BIT-superset-2024-27315
GHSA-h7r6-8qmm-hj5r
Jul 07, 2026
Apache Superset: Improper error handling on alerts
Medium
Network
Low
Low
None
An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-46104
PYSEC-2026-1167
BIT-superset-2023-46104
GHSA-95mg-jgfx-54v9
Jul 07, 2026
Apache Superset uncontrolled resource consumption
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 24 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
Fixed in
2.1.2
3.1.0rc1
References
Updated Jul 07, 2026 · Source: OSV.dev |
3.0.3
patch
|
|
3.1.0rc4
pre
18 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-34693
PYSEC-2026-1183
BIT-superset-2024-34693
GHSA-hcr7-cqwc-q5gq
Jul 07, 2026
Apache Superset server arbitrary file read
Low
Network
Low
High
None
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table. This issue affects Apache Superset before version 3.1.3 and in version 4.0.0. Users are recommended to upgrade to version 4.0.1 or 3.1.3, both of which fix the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 38 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
4.0.0
Fixed in
3.1.3
4.0.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-28148
PYSEC-2026-1153
BIT-superset-2024-28148
GHSA-299q-3p96-5898
Jul 07, 2026
Apache Superset Incorrect Authorization vulnerability
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 36 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
Fixed in
3.1.2
References Updated Jul 07, 2026 · Source: OSV.dev |
3.1.0rc4
pre
|
|
3.1.0rc3
pre
18 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-34693
PYSEC-2026-1183
BIT-superset-2024-34693
GHSA-hcr7-cqwc-q5gq
Jul 07, 2026
Apache Superset server arbitrary file read
Low
Network
Low
High
None
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table. This issue affects Apache Superset before version 3.1.3 and in version 4.0.0. Users are recommended to upgrade to version 4.0.1 or 3.1.3, both of which fix the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 38 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
4.0.0
Fixed in
3.1.3
4.0.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-28148
PYSEC-2026-1153
BIT-superset-2024-28148
GHSA-299q-3p96-5898
Jul 07, 2026
Apache Superset Incorrect Authorization vulnerability
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 36 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
Fixed in
3.1.2
References Updated Jul 07, 2026 · Source: OSV.dev |
3.1.0rc3
pre
|
|
2.1.3
patch
27 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-34693
PYSEC-2026-1183
BIT-superset-2024-34693
GHSA-hcr7-cqwc-q5gq
Jul 07, 2026
Apache Superset server arbitrary file read
Low
Network
Low
High
None
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table. This issue affects Apache Superset before version 3.1.3 and in version 4.0.0. Users are recommended to upgrade to version 4.0.1 or 3.1.3, both of which fix the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 38 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
4.0.0
Fixed in
3.1.3
4.0.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-28148
PYSEC-2026-1153
BIT-superset-2024-28148
GHSA-299q-3p96-5898
Jul 07, 2026
Apache Superset Incorrect Authorization vulnerability
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 36 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
Fixed in
3.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-26016
PYSEC-2026-1158
BIT-superset-2024-26016
GHSA-3v9r-885j-762g
Jul 07, 2026
Apache Superset: Improper authorization validation on dashboards and charts import
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.Users are recommended to upgrade to version 3.1.1, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24779
PYSEC-2026-1191
BIT-superset-2024-24779
GHSA-wr6g-9wcr-cmqj
Jul 07, 2026
Apache Superset: Improper data authorization when creating a new dataset
5.0
/ 10
Medium
Network
Low
Low
None
Changed
Low
None
None
Apache Superset with custom roles that include Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24773
PYSEC-2026-1160
BIT-superset-2024-24773
GHSA-5474-f7g5-273q
Jul 07, 2026
Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24772
PYSEC-2026-1185
BIT-superset-2024-24772
GHSA-m6jm-3v38-76j4
Jul 07, 2026
Apache Superset: Improper Neutralization of custom SQL on embedded context
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-27315
PYSEC-2026-1181
BIT-superset-2024-27315
GHSA-h7r6-8qmm-hj5r
Jul 07, 2026
Apache Superset: Improper error handling on alerts
Medium
Network
Low
Low
None
An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-42502
PYSEC-2026-1182
BIT-superset-2023-42502
GHSA-hc74-9vjm-c9xv
Jul 07, 2026
Apache Superset Open Redirect vulnerability
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 25 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
Fixed in
3.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-42504
PYSEC-2026-1157
BIT-superset-2023-42504
GHSA-3hp7-4qq4-v5c6
Jul 07, 2026
Apache Superset Allocation of Resources Without Limits or Throttling vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service. This issue affects Apache Superset: before 3.0.0 Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 25 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
Fixed in
3.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-42505
PYSEC-2026-1174
BIT-superset-2023-42505
GHSA-fgpw-4w69-j256
Jul 07, 2026
Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerability
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects Apache Superset before 3.0.0. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 25 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
Fixed in
3.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49657
PYSEC-2026-280
BIT-superset-2023-49657
GHSA-rwhh-6x83-84v6
Jun 29, 2026
Cross-site Scripting in Apache superset
9.6
/ 10
Critical
Network
Low
Low
None
Changed
High
High
None
A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For 2.X versions, users should change their config to include: TALISMAN_CONFIG = { "content_security_policy": { "base-uri" : ["'self'"], "default-src": ["'self'"], "img-src": ["'self'", "blob:", "data:"], "worker-src": ["'self'", "blob:"], "connect-src": [ "'self'", " https://api.mapbox.com" https://api.mapbox.com" ;, " https://events.mapbox.com" https://events.mapbox.com" ;, ], "object-src": "'none'", "style-src": [ "'self'", "'unsafe-inline'", ], "script-src": ["'self'", "'strict-dynamic'"], }, "content_security_policy_nonce_in": ["script-src"], "force_https": False, "session_cookie_secure" : False, } Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 28 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
Fixed in
3.0.3
References Updated Jul 01, 2026 · Source: OSV.dev |
2.1.3
patch
|
|
3.1.0rc2
pre
18 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-34693
PYSEC-2026-1183
BIT-superset-2024-34693
GHSA-hcr7-cqwc-q5gq
Jul 07, 2026
Apache Superset server arbitrary file read
Low
Network
Low
High
None
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table. This issue affects Apache Superset before version 3.1.3 and in version 4.0.0. Users are recommended to upgrade to version 4.0.1 or 3.1.3, both of which fix the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 38 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
4.0.0
Fixed in
3.1.3
4.0.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-28148
PYSEC-2026-1153
BIT-superset-2024-28148
GHSA-299q-3p96-5898
Jul 07, 2026
Apache Superset Incorrect Authorization vulnerability
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 36 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
Fixed in
3.1.2
References Updated Jul 07, 2026 · Source: OSV.dev |
3.1.0rc2
pre
|
|
3.1.0rc1
pre
18 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-34693
PYSEC-2026-1183
BIT-superset-2024-34693
GHSA-hcr7-cqwc-q5gq
Jul 07, 2026
Apache Superset server arbitrary file read
Low
Network
Low
High
None
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table. This issue affects Apache Superset before version 3.1.3 and in version 4.0.0. Users are recommended to upgrade to version 4.0.1 or 3.1.3, both of which fix the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 38 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
4.0.0
Fixed in
3.1.3
4.0.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-28148
PYSEC-2026-1153
BIT-superset-2024-28148
GHSA-299q-3p96-5898
Jul 07, 2026
Apache Superset Incorrect Authorization vulnerability
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 36 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
Fixed in
3.1.2
References Updated Jul 07, 2026 · Source: OSV.dev |
3.1.0rc1
pre
|
|
2.1.2
patch
29 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-34693
PYSEC-2026-1183
BIT-superset-2024-34693
GHSA-hcr7-cqwc-q5gq
Jul 07, 2026
Apache Superset server arbitrary file read
Low
Network
Low
High
None
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table. This issue affects Apache Superset before version 3.1.3 and in version 4.0.0. Users are recommended to upgrade to version 4.0.1 or 3.1.3, both of which fix the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 38 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
4.0.0
Fixed in
3.1.3
4.0.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-28148
PYSEC-2026-1153
BIT-superset-2024-28148
GHSA-299q-3p96-5898
Jul 07, 2026
Apache Superset Incorrect Authorization vulnerability
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 36 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
Fixed in
3.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-26016
PYSEC-2026-1158
BIT-superset-2024-26016
GHSA-3v9r-885j-762g
Jul 07, 2026
Apache Superset: Improper authorization validation on dashboards and charts import
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.Users are recommended to upgrade to version 3.1.1, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24779
PYSEC-2026-1191
BIT-superset-2024-24779
GHSA-wr6g-9wcr-cmqj
Jul 07, 2026
Apache Superset: Improper data authorization when creating a new dataset
5.0
/ 10
Medium
Network
Low
Low
None
Changed
Low
None
None
Apache Superset with custom roles that include Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24773
PYSEC-2026-1160
BIT-superset-2024-24773
GHSA-5474-f7g5-273q
Jul 07, 2026
Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24772
PYSEC-2026-1185
BIT-superset-2024-24772
GHSA-m6jm-3v38-76j4
Jul 07, 2026
Apache Superset: Improper Neutralization of custom SQL on embedded context
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-27315
PYSEC-2026-1181
BIT-superset-2024-27315
GHSA-h7r6-8qmm-hj5r
Jul 07, 2026
Apache Superset: Improper error handling on alerts
Medium
Network
Low
Low
None
An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49734
PYSEC-2026-1180
BIT-superset-2023-49734
GHSA-g49j-j489-3xpf
Jul 07, 2026
Apache Superset incorrect write permissions vulnerability
7.7
/ 10
High
Network
Low
Low
None
Changed
None
High
None
An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 22 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
3.0.0
3.0.1
Fixed in
2.1.3
3.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49736
PYSEC-2026-1184
BIT-superset-2023-49736
GHSA-jfxj-xf67-x723
Jul 07, 2026
Apache Superset SQL injection vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 2.1.3 or 3.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 22 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
3.0.0
3.0.1
Fixed in
2.1.3
3.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-42502
PYSEC-2026-1182
BIT-superset-2023-42502
GHSA-hc74-9vjm-c9xv
Jul 07, 2026
Apache Superset Open Redirect vulnerability
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 25 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
Fixed in
3.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-42504
PYSEC-2026-1157
BIT-superset-2023-42504
GHSA-3hp7-4qq4-v5c6
Jul 07, 2026
Apache Superset Allocation of Resources Without Limits or Throttling vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service. This issue affects Apache Superset: before 3.0.0 Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 25 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
Fixed in
3.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-42505
PYSEC-2026-1174
BIT-superset-2023-42505
GHSA-fgpw-4w69-j256
Jul 07, 2026
Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerability
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects Apache Superset before 3.0.0. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 25 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
Fixed in
3.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49657
PYSEC-2026-280
BIT-superset-2023-49657
GHSA-rwhh-6x83-84v6
Jun 29, 2026
Cross-site Scripting in Apache superset
9.6
/ 10
Critical
Network
Low
Low
None
Changed
High
High
None
A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For 2.X versions, users should change their config to include: TALISMAN_CONFIG = { "content_security_policy": { "base-uri" : ["'self'"], "default-src": ["'self'"], "img-src": ["'self'", "blob:", "data:"], "worker-src": ["'self'", "blob:"], "connect-src": [ "'self'", " https://api.mapbox.com" https://api.mapbox.com" ;, " https://events.mapbox.com" https://events.mapbox.com" ;, ], "object-src": "'none'", "style-src": [ "'self'", "'unsafe-inline'", ], "script-src": ["'self'", "'strict-dynamic'"], }, "content_security_policy_nonce_in": ["script-src"], "force_https": False, "session_cookie_secure" : False, } Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 28 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
Fixed in
3.0.3
References Updated Jul 01, 2026 · Source: OSV.dev |
2.1.2
patch
|
|
3.0.2
patch
25 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-34693
PYSEC-2026-1183
BIT-superset-2024-34693
GHSA-hcr7-cqwc-q5gq
Jul 07, 2026
Apache Superset server arbitrary file read
Low
Network
Low
High
None
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table. This issue affects Apache Superset before version 3.1.3 and in version 4.0.0. Users are recommended to upgrade to version 4.0.1 or 3.1.3, both of which fix the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 38 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
4.0.0
Fixed in
3.1.3
4.0.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-28148
PYSEC-2026-1153
BIT-superset-2024-28148
GHSA-299q-3p96-5898
Jul 07, 2026
Apache Superset Incorrect Authorization vulnerability
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 36 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
Fixed in
3.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-26016
PYSEC-2026-1158
BIT-superset-2024-26016
GHSA-3v9r-885j-762g
Jul 07, 2026
Apache Superset: Improper authorization validation on dashboards and charts import
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.Users are recommended to upgrade to version 3.1.1, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24779
PYSEC-2026-1191
BIT-superset-2024-24779
GHSA-wr6g-9wcr-cmqj
Jul 07, 2026
Apache Superset: Improper data authorization when creating a new dataset
5.0
/ 10
Medium
Network
Low
Low
None
Changed
Low
None
None
Apache Superset with custom roles that include Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24773
PYSEC-2026-1160
BIT-superset-2024-24773
GHSA-5474-f7g5-273q
Jul 07, 2026
Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24772
PYSEC-2026-1185
BIT-superset-2024-24772
GHSA-m6jm-3v38-76j4
Jul 07, 2026
Apache Superset: Improper Neutralization of custom SQL on embedded context
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-27315
PYSEC-2026-1181
BIT-superset-2024-27315
GHSA-h7r6-8qmm-hj5r
Jul 07, 2026
Apache Superset: Improper error handling on alerts
Medium
Network
Low
Low
None
An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-46104
PYSEC-2026-1167
BIT-superset-2023-46104
GHSA-95mg-jgfx-54v9
Jul 07, 2026
Apache Superset uncontrolled resource consumption
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 24 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
Fixed in
2.1.2
3.1.0rc1
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49657
PYSEC-2026-280
BIT-superset-2023-49657
GHSA-rwhh-6x83-84v6
Jun 29, 2026
Cross-site Scripting in Apache superset
9.6
/ 10
Critical
Network
Low
Low
None
Changed
High
High
None
A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For 2.X versions, users should change their config to include: TALISMAN_CONFIG = { "content_security_policy": { "base-uri" : ["'self'"], "default-src": ["'self'"], "img-src": ["'self'", "blob:", "data:"], "worker-src": ["'self'", "blob:"], "connect-src": [ "'self'", " https://api.mapbox.com" https://api.mapbox.com" ;, " https://events.mapbox.com" https://events.mapbox.com" ;, ], "object-src": "'none'", "style-src": [ "'self'", "'unsafe-inline'", ], "script-src": ["'self'", "'strict-dynamic'"], }, "content_security_policy_nonce_in": ["script-src"], "force_https": False, "session_cookie_secure" : False, } Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 28 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
Fixed in
3.0.3
References Updated Jul 01, 2026 · Source: OSV.dev |
3.0.2
patch
|
|
3.0.1
patch
27 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-34693
PYSEC-2026-1183
BIT-superset-2024-34693
GHSA-hcr7-cqwc-q5gq
Jul 07, 2026
Apache Superset server arbitrary file read
Low
Network
Low
High
None
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table. This issue affects Apache Superset before version 3.1.3 and in version 4.0.0. Users are recommended to upgrade to version 4.0.1 or 3.1.3, both of which fix the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 38 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
4.0.0
Fixed in
3.1.3
4.0.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-28148
PYSEC-2026-1153
BIT-superset-2024-28148
GHSA-299q-3p96-5898
Jul 07, 2026
Apache Superset Incorrect Authorization vulnerability
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 36 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
Fixed in
3.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-26016
PYSEC-2026-1158
BIT-superset-2024-26016
GHSA-3v9r-885j-762g
Jul 07, 2026
Apache Superset: Improper authorization validation on dashboards and charts import
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.Users are recommended to upgrade to version 3.1.1, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24779
PYSEC-2026-1191
BIT-superset-2024-24779
GHSA-wr6g-9wcr-cmqj
Jul 07, 2026
Apache Superset: Improper data authorization when creating a new dataset
5.0
/ 10
Medium
Network
Low
Low
None
Changed
Low
None
None
Apache Superset with custom roles that include Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24773
PYSEC-2026-1160
BIT-superset-2024-24773
GHSA-5474-f7g5-273q
Jul 07, 2026
Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24772
PYSEC-2026-1185
BIT-superset-2024-24772
GHSA-m6jm-3v38-76j4
Jul 07, 2026
Apache Superset: Improper Neutralization of custom SQL on embedded context
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-27315
PYSEC-2026-1181
BIT-superset-2024-27315
GHSA-h7r6-8qmm-hj5r
Jul 07, 2026
Apache Superset: Improper error handling on alerts
Medium
Network
Low
Low
None
An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49734
PYSEC-2026-1180
BIT-superset-2023-49734
GHSA-g49j-j489-3xpf
Jul 07, 2026
Apache Superset incorrect write permissions vulnerability
7.7
/ 10
High
Network
Low
Low
None
Changed
None
High
None
An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 22 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
3.0.0
3.0.1
Fixed in
2.1.3
3.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49736
PYSEC-2026-1184
BIT-superset-2023-49736
GHSA-jfxj-xf67-x723
Jul 07, 2026
Apache Superset SQL injection vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 2.1.3 or 3.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 22 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
3.0.0
3.0.1
Fixed in
2.1.3
3.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-46104
PYSEC-2026-1167
BIT-superset-2023-46104
GHSA-95mg-jgfx-54v9
Jul 07, 2026
Apache Superset uncontrolled resource consumption
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 24 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
Fixed in
2.1.2
3.1.0rc1
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49657
PYSEC-2026-280
BIT-superset-2023-49657
GHSA-rwhh-6x83-84v6
Jun 29, 2026
Cross-site Scripting in Apache superset
9.6
/ 10
Critical
Network
Low
Low
None
Changed
High
High
None
A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For 2.X versions, users should change their config to include: TALISMAN_CONFIG = { "content_security_policy": { "base-uri" : ["'self'"], "default-src": ["'self'"], "img-src": ["'self'", "blob:", "data:"], "worker-src": ["'self'", "blob:"], "connect-src": [ "'self'", " https://api.mapbox.com" https://api.mapbox.com" ;, " https://events.mapbox.com" https://events.mapbox.com" ;, ], "object-src": "'none'", "style-src": [ "'self'", "'unsafe-inline'", ], "script-src": ["'self'", "'strict-dynamic'"], }, "content_security_policy_nonce_in": ["script-src"], "force_https": False, "session_cookie_secure" : False, } Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 28 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
Fixed in
3.0.3
References Updated Jul 01, 2026 · Source: OSV.dev |
3.0.1
patch
|
|
3.0.0
major
27 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-34693
PYSEC-2026-1183
BIT-superset-2024-34693
GHSA-hcr7-cqwc-q5gq
Jul 07, 2026
Apache Superset server arbitrary file read
Low
Network
Low
High
None
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table. This issue affects Apache Superset before version 3.1.3 and in version 4.0.0. Users are recommended to upgrade to version 4.0.1 or 3.1.3, both of which fix the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 38 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
4.0.0
Fixed in
3.1.3
4.0.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-28148
PYSEC-2026-1153
BIT-superset-2024-28148
GHSA-299q-3p96-5898
Jul 07, 2026
Apache Superset Incorrect Authorization vulnerability
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 36 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
Fixed in
3.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-26016
PYSEC-2026-1158
BIT-superset-2024-26016
GHSA-3v9r-885j-762g
Jul 07, 2026
Apache Superset: Improper authorization validation on dashboards and charts import
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.Users are recommended to upgrade to version 3.1.1, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24779
PYSEC-2026-1191
BIT-superset-2024-24779
GHSA-wr6g-9wcr-cmqj
Jul 07, 2026
Apache Superset: Improper data authorization when creating a new dataset
5.0
/ 10
Medium
Network
Low
Low
None
Changed
Low
None
None
Apache Superset with custom roles that include Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24773
PYSEC-2026-1160
BIT-superset-2024-24773
GHSA-5474-f7g5-273q
Jul 07, 2026
Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24772
PYSEC-2026-1185
BIT-superset-2024-24772
GHSA-m6jm-3v38-76j4
Jul 07, 2026
Apache Superset: Improper Neutralization of custom SQL on embedded context
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-27315
PYSEC-2026-1181
BIT-superset-2024-27315
GHSA-h7r6-8qmm-hj5r
Jul 07, 2026
Apache Superset: Improper error handling on alerts
Medium
Network
Low
Low
None
An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49734
PYSEC-2026-1180
BIT-superset-2023-49734
GHSA-g49j-j489-3xpf
Jul 07, 2026
Apache Superset incorrect write permissions vulnerability
7.7
/ 10
High
Network
Low
Low
None
Changed
None
High
None
An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 22 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
3.0.0
3.0.1
Fixed in
2.1.3
3.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49736
PYSEC-2026-1184
BIT-superset-2023-49736
GHSA-jfxj-xf67-x723
Jul 07, 2026
Apache Superset SQL injection vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 2.1.3 or 3.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 22 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
3.0.0
3.0.1
Fixed in
2.1.3
3.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-46104
PYSEC-2026-1167
BIT-superset-2023-46104
GHSA-95mg-jgfx-54v9
Jul 07, 2026
Apache Superset uncontrolled resource consumption
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 24 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
Fixed in
2.1.2
3.1.0rc1
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49657
PYSEC-2026-280
BIT-superset-2023-49657
GHSA-rwhh-6x83-84v6
Jun 29, 2026
Cross-site Scripting in Apache superset
9.6
/ 10
Critical
Network
Low
Low
None
Changed
High
High
None
A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For 2.X versions, users should change their config to include: TALISMAN_CONFIG = { "content_security_policy": { "base-uri" : ["'self'"], "default-src": ["'self'"], "img-src": ["'self'", "blob:", "data:"], "worker-src": ["'self'", "blob:"], "connect-src": [ "'self'", " https://api.mapbox.com" https://api.mapbox.com" ;, " https://events.mapbox.com" https://events.mapbox.com" ;, ], "object-src": "'none'", "style-src": [ "'self'", "'unsafe-inline'", ], "script-src": ["'self'", "'strict-dynamic'"], }, "content_security_policy_nonce_in": ["script-src"], "force_https": False, "session_cookie_secure" : False, } Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 28 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
Fixed in
3.0.3
References Updated Jul 01, 2026 · Source: OSV.dev |
3.0.0
major
|
|
3.0.0rc4
pre
27 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-34693
PYSEC-2026-1183
BIT-superset-2024-34693
GHSA-hcr7-cqwc-q5gq
Jul 07, 2026
Apache Superset server arbitrary file read
Low
Network
Low
High
None
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table. This issue affects Apache Superset before version 3.1.3 and in version 4.0.0. Users are recommended to upgrade to version 4.0.1 or 3.1.3, both of which fix the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 38 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
4.0.0
Fixed in
3.1.3
4.0.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-28148
PYSEC-2026-1153
BIT-superset-2024-28148
GHSA-299q-3p96-5898
Jul 07, 2026
Apache Superset Incorrect Authorization vulnerability
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 36 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
Fixed in
3.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-26016
PYSEC-2026-1158
BIT-superset-2024-26016
GHSA-3v9r-885j-762g
Jul 07, 2026
Apache Superset: Improper authorization validation on dashboards and charts import
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.Users are recommended to upgrade to version 3.1.1, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24779
PYSEC-2026-1191
BIT-superset-2024-24779
GHSA-wr6g-9wcr-cmqj
Jul 07, 2026
Apache Superset: Improper data authorization when creating a new dataset
5.0
/ 10
Medium
Network
Low
Low
None
Changed
Low
None
None
Apache Superset with custom roles that include Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24773
PYSEC-2026-1160
BIT-superset-2024-24773
GHSA-5474-f7g5-273q
Jul 07, 2026
Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24772
PYSEC-2026-1185
BIT-superset-2024-24772
GHSA-m6jm-3v38-76j4
Jul 07, 2026
Apache Superset: Improper Neutralization of custom SQL on embedded context
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-27315
PYSEC-2026-1181
BIT-superset-2024-27315
GHSA-h7r6-8qmm-hj5r
Jul 07, 2026
Apache Superset: Improper error handling on alerts
Medium
Network
Low
Low
None
An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-42502
PYSEC-2026-1182
BIT-superset-2023-42502
GHSA-hc74-9vjm-c9xv
Jul 07, 2026
Apache Superset Open Redirect vulnerability
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 25 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
Fixed in
3.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-42504
PYSEC-2026-1157
BIT-superset-2023-42504
GHSA-3hp7-4qq4-v5c6
Jul 07, 2026
Apache Superset Allocation of Resources Without Limits or Throttling vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service. This issue affects Apache Superset: before 3.0.0 Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 25 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
Fixed in
3.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-42505
PYSEC-2026-1174
BIT-superset-2023-42505
GHSA-fgpw-4w69-j256
Jul 07, 2026
Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerability
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects Apache Superset before 3.0.0. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 25 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
Fixed in
3.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49657
PYSEC-2026-280
BIT-superset-2023-49657
GHSA-rwhh-6x83-84v6
Jun 29, 2026
Cross-site Scripting in Apache superset
9.6
/ 10
Critical
Network
Low
Low
None
Changed
High
High
None
A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For 2.X versions, users should change their config to include: TALISMAN_CONFIG = { "content_security_policy": { "base-uri" : ["'self'"], "default-src": ["'self'"], "img-src": ["'self'", "blob:", "data:"], "worker-src": ["'self'", "blob:"], "connect-src": [ "'self'", " https://api.mapbox.com" https://api.mapbox.com" ;, " https://events.mapbox.com" https://events.mapbox.com" ;, ], "object-src": "'none'", "style-src": [ "'self'", "'unsafe-inline'", ], "script-src": ["'self'", "'strict-dynamic'"], }, "content_security_policy_nonce_in": ["script-src"], "force_https": False, "session_cookie_secure" : False, } Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 28 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
Fixed in
3.0.3
References Updated Jul 01, 2026 · Source: OSV.dev |
3.0.0rc4
pre
|
|
2.1.1
patch
33 CVEs
CVE-2026-23984
PYSEC-2026-2376
BIT-superset-2026-23984
GHSA-mwf2-qr4v-94h2
Jul 13, 2026
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
High
Network
Low
Low
None
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23983
PYSEC-2026-2375
BIT-superset-2026-23983
GHSA-h294-8fxm-m2pj
Jul 13, 2026
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium
Network
Low
Low
None
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default) Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23969
PYSEC-2026-2373
BIT-superset-2026-23969
GHSA-48m2-v2r8-h23m
Jul 13, 2026
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium
Network
Low
Low
None
Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23980
PYSEC-2026-2374
BIT-superset-2026-23980
GHSA-gvxg-9hqx-f4rg
Jul 13, 2026
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2026-23982
PYSEC-2026-2372
BIT-superset-2026-23982
GHSA-3m2g-v7jf-7fxc
Jul 13, 2026
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
High
Network
Low
Low
None
An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 65 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
6.0.0rc1
6.0.0rc2
6.0.0rc3
6.0.0rc4
Fixed in
6.0.0
References Updated Jul 13, 2026 · Source: OSV.dev
CVE-2025-55674
PYSEC-2026-1178
BIT-superset-2025-55674
GHSA-fxgf-3xh6-m2pp
Jul 07, 2026
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium
Network
Low
Low
None
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55673
PYSEC-2026-1169
BIT-superset-2025-55673
GHSA-9g5x-mm39-wg9r
Jul 07, 2026
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium
Network
Low
Low
None
When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user. This issue affects Apache Superset: before 4.1.3. Users are recommended to upgrade to version 4.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 53 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3rc1
4.1.3rc2
Fixed in
4.1.3.post1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55672
PYSEC-2026-1176
BIT-superset-2025-55672
GHSA-fj97-2v9x-w5m4
Jul 07, 2026
Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability
Medium
Network
Low
Low
None
A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload is not properly sanitized and gets executed in the victim's browser when they hover over the chart, potentially leading to session hijacking or the execution of arbitrary commands on behalf of the user. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-55675
PYSEC-2026-1186
BIT-superset-2025-55675
GHSA-mhpq-m962-mg92
Jul 07, 2026
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium
Network
Low
Low
None
Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id in the URL, an attacker can enumerate and confirm the existence and names of protected datasources, leading to sensitive information disclosure. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 60 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2
4.1.2rc1
4.1.3.post1
4.1.3rc1
4.1.3rc2
4.1.4
4.1.4rc1
5.0.0rc1
5.0.0rc2
5.0.0rc3
5.0.0rc4
Fixed in
5.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-48912
PYSEC-2026-1164
BIT-superset-2025-48912
GHSA-8w7f-8pr9-xgwj
Jul 07, 2026
Apache Superset: Improper authorization bypass on row level security via SQL Injection
High
Network
Low
Low
None
An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing defenses ultimately granting unauthorized access to data. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2025-27696
PYSEC-2026-1189
BIT-superset-2025-27696
GHSA-w6c7-j32f-rq8j
Jul 07, 2026
Apache Superset Allows Ownership Takeover
Medium
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users are recommended to upgrade to version 4.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 50 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0
4.1.0rc2
4.1.0rc3
4.1.0rc4
4.1.1
4.1.1rc1
4.1.2rc1
Fixed in
4.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-55633
PYSEC-2026-1162
BIT-superset-2024-55633
GHSA-787v-v9vq-4rgv
Jul 07, 2026
Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access
High
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53948
PYSEC-2026-1154
BIT-superset-2024-53948
GHSA-2cx9-54hp-r698
Jul 07, 2026
Apache Superset: Error verbosity exposes metadata in analytics databases
Low
Network
Low
Low
None
Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53947
PYSEC-2026-1165
BIT-superset-2024-53947
GHSA-92qf-8gh3-gwcm
Jul 07, 2026
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Medium
Network
Low
Low
None
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 46 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-53949
PYSEC-2026-1156
BIT-superset-2024-53949
GHSA-35fc-9hrj-3585
Jul 07, 2026
Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
Critical
Network
Low
Low
None
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. Affected versions
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
+ 22 more Show less
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
4.0.2
4.1.0rc2
4.1.0rc3
4.1.0rc4
Fixed in
4.1.0
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-39887
PYSEC-2026-1155
BIT-superset-2024-39887
GHSA-2q6j-vpvr-6pvj
Jul 07, 2026
Apache Superset vulnerable to improper SQL authorization
Medium
Network
Low
None
None
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection. This issue affects Apache Superset: before 4.0.2. Users are recommended to upgrade to version 4.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 42 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
3.1.3
4.0.0
4.0.0rc1
4.0.0rc2
4.0.1
Fixed in
4.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-34693
PYSEC-2026-1183
BIT-superset-2024-34693
GHSA-hcr7-cqwc-q5gq
Jul 07, 2026
Apache Superset server arbitrary file read
Low
Network
Low
High
None
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table. This issue affects Apache Superset before version 3.1.3 and in version 4.0.0. Users are recommended to upgrade to version 4.0.1 or 3.1.3, both of which fix the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 38 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
3.1.2
4.0.0
Fixed in
3.1.3
4.0.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-28148
PYSEC-2026-1153
BIT-superset-2024-28148
GHSA-299q-3p96-5898
Jul 07, 2026
Apache Superset Incorrect Authorization vulnerability
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2. Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 36 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.0.4
3.1.0
3.1.0rc1
3.1.0rc2
3.1.0rc3
3.1.0rc4
3.1.1
Fixed in
3.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-26016
PYSEC-2026-1158
BIT-superset-2024-26016
GHSA-3v9r-885j-762g
Jul 07, 2026
Apache Superset: Improper authorization validation on dashboards and charts import
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be subject to validation based on data access privileges. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.Users are recommended to upgrade to version 3.1.1, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24779
PYSEC-2026-1191
BIT-superset-2024-24779
GHSA-wr6g-9wcr-cmqj
Jul 07, 2026
Apache Superset: Improper data authorization when creating a new dataset
5.0
/ 10
Medium
Network
Low
Low
None
Changed
Low
None
None
Apache Superset with custom roles that include Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24773
PYSEC-2026-1160
BIT-superset-2024-24773
GHSA-5474-f7g5-273q
Jul 07, 2026
Apache Superset: Improper validation of SQL statements allows for unauthorized access to data
4.9
/ 10
Medium
Network
Low
High
None
Unchanged
High
None
None
Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-24772
PYSEC-2026-1185
BIT-superset-2024-24772
GHSA-m6jm-3v38-76j4
Jul 07, 2026
Apache Superset: Improper Neutralization of custom SQL on embedded context
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2024-27315
PYSEC-2026-1181
BIT-superset-2024-27315
GHSA-h7r6-8qmm-hj5r
Jul 07, 2026
Apache Superset: Improper error handling on alerts
Medium
Network
Low
Low
None
An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 30 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
3.0.3
3.1.0
Fixed in
3.0.4
3.1.1
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49734
PYSEC-2026-1180
BIT-superset-2023-49734
GHSA-g49j-j489-3xpf
Jul 07, 2026
Apache Superset incorrect write permissions vulnerability
7.7
/ 10
High
Network
Low
Low
None
Changed
None
High
None
An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these charts.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 3.0.2 or 2.1.3, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 22 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
3.0.0
3.0.1
Fixed in
2.1.3
3.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49736
PYSEC-2026-1184
BIT-superset-2023-49736
GHSA-jfxj-xf67-x723
Jul 07, 2026
Apache Superset SQL injection vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
High
None
A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.3, from 3.0.0 before 3.0.2. Users are recommended to upgrade to version 2.1.3 or 3.0.2, which fixes the issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 22 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
3.0.0
3.0.1
Fixed in
2.1.3
3.0.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-46104
PYSEC-2026-1167
BIT-superset-2023-46104
GHSA-95mg-jgfx-54v9
Jul 07, 2026
Apache Superset uncontrolled resource consumption
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 24 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
3.0.0
3.0.1
3.0.2
3.0.3
3.0.4
Fixed in
2.1.2
3.1.0rc1
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-40610
PYSEC-2026-1173
BIT-superset-2023-40610
GHSA-f678-j579-4xf5
Jul 07, 2026
Apache Superset - Elevation of Privilege
7.3
/ 10
High
Adjacent
Low
Low
None
Unchanged
High
High
None
OverviewAn attacker with access to the SQL Lab and the ab_user and ab_user_role tables can elevate his privileges to become administrator. DetailsOn a more general level, diverse tables who are supposed to be only readable can be modified using the WITH … AS and RETURNING keywords. Modification of the table key_value can also be done, which could lead to a Remote Code Execution (cf. "V7 - Insecure deserialization leading to remote code execution" report vulnerability). Proof of ConceptSome tables are supposed to accept only SELECT requests from the SQL tab.
But this protection can be bypassed by using the WITH … AS () syntax with RETURNING value after the INSERT / UPDATE / DELETE query. INSERT query accepted by the database due to the use of WITH … AS ( … RETURNING ) syntax: WITH a AS ( INSERT INTO ab_user (id, first_name, last_name, username, email, password) VALUES (2, ‘injected_admin’, ‘injected_admin’, ‘injected_admin’, ‘injected_admin@gmail.com’, ‘{PASSWORD_HASH}’) RETURNING id ) SELECT * FROM a; PoC_2
This method can also be used with UPDATE or DELETE request. A user with access to SELECT on the tables ab_user_role can escalate his privilege to become administrator.
This technique can also be used to inject or modify values of the table key_value, which can potentially lead to a Remote Code Execution (cf. ...). SolutionOrange recommendationTo fix this vulnerability, we recommends reenforcing the SELECT filter to spot INSERT / UPDATE / DELETE keywords even in WITH requests. Security patchUpgrade to Superset version 2.1.2. Referenceshttps://nvd.nist.gov/vuln/detail/CVE-2023-40610 https://lists.apache.org/thread/jvgxpk4dbxyqtsgtl4pdgbd520rc0rot CreditsLEXFO for Orange Innovation Orange CERT-CC at Orange group TimelineDate reported: July 27, 2023 Date fixed: November 27, 2023 Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 19 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
Fixed in
2.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-42502
PYSEC-2026-1182
BIT-superset-2023-42502
GHSA-hc74-9vjm-c9xv
Jul 07, 2026
Apache Superset Open Redirect vulnerability
5.4
/ 10
Medium
Network
Low
Low
Required
Changed
Low
Low
None
An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 25 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
Fixed in
3.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-42504
PYSEC-2026-1157
BIT-superset-2023-42504
GHSA-3hp7-4qq4-v5c6
Jul 07, 2026
Apache Superset Allocation of Resources Without Limits or Throttling vulnerability
6.5
/ 10
Medium
Network
Low
Low
None
Unchanged
None
None
High
An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service. This issue affects Apache Superset: before 3.0.0 Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 25 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
Fixed in
3.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-42505
PYSEC-2026-1174
BIT-superset-2023-42505
GHSA-fgpw-4w69-j256
Jul 07, 2026
Apache Superset Exposure of Sensitive Information to an Unauthorized Actor vulnerability
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
An authenticated user with read permissions on database connections metadata could potentially access sensitive information such as the connection's username. This issue affects Apache Superset before 3.0.0. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 25 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
Fixed in
3.0.0
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-42501
PYSEC-2026-1188
BIT-superset-2023-42501
GHSA-vv65-fjfj-4736
Jul 07, 2026
Apache Superset has Incorrect Default Permissions
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Unnecessary read permissions within the Gamma role would allow authenticated users to read configured CSS templates and annotations.
This issue affects Apache Superset: before 2.1.2.
Users should upgrade to version or above 2.1.2 and run Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 19 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
Fixed in
2.1.2
References Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-43701
PYSEC-2026-1190
BIT-superset-2023-43701
GHSA-wq8q-99p5-xfrw
Jul 07, 2026
Apache Superset Cross-site Scripting vulnerability
4.3
/ 10
Medium
Network
Low
Low
None
Unchanged
Low
None
None
Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code could get executed if a user specifically accesses a specific deprecated API endpoint. This issue affects Apache Superset versions prior to 2.1.2. Users are recommended to upgrade to version 2.1.2, which fixes this issue. Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 19 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
Fixed in
2.1.2
References
Updated Jul 07, 2026 · Source: OSV.dev
CVE-2023-49657
PYSEC-2026-280
BIT-superset-2023-49657
GHSA-rwhh-6x83-84v6
Jun 29, 2026
Cross-site Scripting in Apache superset
9.6
/ 10
Critical
Network
Low
Low
None
Changed
High
High
None
A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML snippet that would act as a stored XSS. For 2.X versions, users should change their config to include: TALISMAN_CONFIG = { "content_security_policy": { "base-uri" : ["'self'"], "default-src": ["'self'"], "img-src": ["'self'", "blob:", "data:"], "worker-src": ["'self'", "blob:"], "connect-src": [ "'self'", " https://api.mapbox.com" https://api.mapbox.com" ;, " https://events.mapbox.com" https://events.mapbox.com" ;, ], "object-src": "'none'", "style-src": [ "'self'", "'unsafe-inline'", ], "script-src": ["'self'", "'strict-dynamic'"], }, "content_security_policy_nonce_in": ["script-src"], "force_https": False, "session_cookie_secure" : False, } Affected versions
0.34.0
0.34.1
0.35.1
0.35.2
0.36.0
0.37.0
0.37.1
0.37.2
0.38.0
0.38.1
1.0.0
1.0.1
+ 28 more Show less
1.1.0
1.2.0
1.3.0
1.3.1
1.3.2
1.4.0
1.4.1
1.4.2
1.5.0
1.5.1
1.5.2
1.5.3
2.0.0
2.0.1
2.1.0
2.1.1
2.1.1rc1
2.1.1rc2
2.1.1rc3
2.1.2
2.1.3
3.0.0
3.0.0rc1
3.0.0rc2
3.0.0rc3
3.0.0rc4
3.0.1
3.0.2
Fixed in
3.0.3
References Updated Jul 01, 2026 · Source: OSV.dev |
2.1.1
patch
|
