CVE-2023-36388: Apache Superset: Improper API permission for low privilege users allows for SSRF

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-09-06 · updated 2026-06-17
Weakness: CWE-918

Description

Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.

Affected products

Apache Superset: through 2.1.0

References

https://lists.apache.org/thread/ccmjjz4jp17yc2kcd18qshmdtf7qorfs
https://lists.apache.org/thread/ccmjjz4jp17yc2kcd18qshmdtf7qorfs

Get alerted when CVE-2023-36388 or the next vulnerability affects your stack