Skip to content
OpenAdvisories

Product · Apache Software Foundation

Apache Superset

65 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-23980 Public exploit

    Apache Superset: Improper Neutralization of Special Elements used in a SQL Command

    Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affec…

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 6.8
    CVE-2024-34693 Public exploit

    Apache Superset: Server arbitrary file read

    Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allo…

    Apache Software Foundation Apache Superset apache-superset PyPI
  • Medium 6.6
    CVE-2023-37941 Public exploit EPSS 35%

    Apache Superset: Metadata db write access can lead to remote code execution

    If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend. The Superset metadata db is an 'internal' component that is t…

    Apache Software Foundation Apache Superset apache-superset PyPI