What’s Vulnerable › Vulnerabilities

CVE-2023-30776: Apache Superset: Database connection password leak

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-04-24 · updated 2026-06-17
• Weakness: CWE-522

Description

An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects Apache Superset version 1.3.0 up to 2.0.1.

Affected products

• Apache Superset: from 1.3.0 through 2.0.1

References

• http://www.openwall.com/lists/oss-security/2023/04/24/3
• https://lists.apache.org/thread/s9w9w10mt2sngk3solwnmq5k7md53tsz
• http://www.openwall.com/lists/oss-security/2023/04/24/3
• https://lists.apache.org/thread/s9w9w10mt2sngk3solwnmq5k7md53tsz

Get alerted when CVE-2023-30776 or the next vulnerability affects your stack