Description
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Superset | ≤ 2.1.0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | apache-superset | <= 2.1.0 | — | GHSA-cpvx-2365-466c |
| PyPI | apache-superset | < 2.1.1 | 2.1.1 | PYSEC-2026-1172 |
References
- https://lists.apache.org/thread/y65t1of7hb445n86o1vdzjct7rfwlx75 vendor-advisory