Skip to content
OpenAdvisories
Medium WID-SEC-2026-0502 5 CVEs

Apache Superset: Mehrere Schwachstellen

Published Feb 24, 2026 · Updated Feb 24, 2026 · de-DE

Vendor: Apache Product: Superset

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Apache Superset ausnutzen, um Informationen offenzulegen, Daten zu manipulieren oder Sicherheitsmaßnahmen zu umgehen.

Product

Apache Superset ist eine Open-Source-Plattform zur Datenexploration und -visualisierung.

Vulnerabilities 5

  • High 7.1
    CVE-2026-23982

    Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass

    An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an auth…

    Apache Software Foundation Apache Superset apache-superset PyPI
  • High 7.1
    CVE-2026-23984

    Apache Superset: SQLLab Read-Only Bypass on PostgreSQL

    An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data…

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 5.3
    CVE-2026-23969

    Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering

    Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was…

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 5.3
    CVE-2026-23980 Public exploit

    Apache Superset: Improper Neutralization of Special Elements used in a SQL Command

    Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affec…

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Low 2.3
    CVE-2026-23983

    Apache Superset: Sensitive Data Exposure via REST API (disabled by default)

    A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these…

    Apache Software Foundation Apache Superset apache-superset PyPI

Revision history

  1. #1

    Initiale Fassung

References