What’s Vulnerable › Products

Apache Superset vulnerabilities

70 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 17 published in the last 12 months.

Check whether your Apache Superset version is affected

Exploited Apache Superset vulnerabilities

• CVE-2023-27524 — Apache Superset Insecure Default Initialization of Resource Vulnerability

Latest Apache Superset vulnerabilities

• CVE-2026-23985 — Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser (CVSS 6.5)
• CVE-2026-23981 — Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification (CVSS 4.3)
• CVE-2026-23984 — Apache Superset: SQLLab Read-Only Bypass on PostgreSQL (CVSS 6.5)
• CVE-2026-23983 — Apache Superset: Sensitive Data Exposure via REST API (disabled by default) (CVSS 6.5)
• CVE-2026-23982 — Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass (CVSS 6.5)
• CVE-2026-23980 — Apache Superset: Improper Neutralization of Special Elements used in a SQL Command (CVSS 6.5)
• CVE-2026-23969 — Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering (CVSS 6.5)
• CVE-2025-55675 — Apache Superset: Incorrect datasource authorization on REST API (CVSS 6.5)
• CVE-2025-55674 — Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions (CVSS 6.5)
• CVE-2025-55673 — Apache Superset: Metadata exposure in embedded charts (CVSS 4.3)
• CVE-2025-55672 — Apache Superset: Stored XSS on charts metadata (CVSS 5.4)
• CVE-2025-48912 — Apache Superset: Improper authorization bypass on row level security via SQL Injection (CVSS 6.5)
• CVE-2025-27696 — Apache Superset: Incorrect authorization leading to resource ownership takeover (CVSS 8.8)
• CVE-2024-55633 — Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access (CVSS 6.5)
• CVE-2024-53949 — Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled (CVSS 6.5)
• CVE-2024-53948 — Apache Superset: Error verbosity exposes metadata in analytics databases (CVSS 5.3)
• CVE-2024-53947 — Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions (CVSS 9.8)
• CVE-2024-39887 — Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions (CVSS 9.8)
• CVE-2024-34693 — Apache Superset: Server arbitrary file read (CVSS 5.3)
• CVE-2024-28148 — Apache Superset: Incorrect datasource authorization on explore REST API (CVSS 4.3)
• CVE-2024-26016 — Apache Superset: Improper authorization validation on dashboards and charts import (CVSS 5.4)
• CVE-2024-24779 — Apache Superset: Improper data authorization when creating a new dataset (CVSS 6.5)
• CVE-2024-24773 — Apache Superset: Improper validation of SQL statements allows for unauthorized access to data (CVSS 6.5)
• CVE-2024-24772 — Apache Superset: Improper Neutralisation of custom SQL on embedded context (CVSS 4.3)
• CVE-2024-27315 — Apache Superset: Improper error handling on alerts (CVSS 4.3)