What’s Vulnerable › Vulnerabilities

CVE-2022-41703: Apache Superset: SQL injection vulnerability in adhoc clauses

• Severity: medium (CVSS 5.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-01-16 · updated 2026-06-17
• Weakness: CWE-89

Description

A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value). This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Affected products

• Apache Superset: through 1.5.2; 2.0.0, 2.0.0-rc1, 2.0.0-rc2

References

• https://lists.apache.org/thread/g7jjw0okxjk5y57pbbxy19ydw42kqcos
• https://lists.apache.org/thread/g7jjw0okxjk5y57pbbxy19ydw42kqcos

Get alerted when CVE-2022-41703 or the next vulnerability affects your stack