What’s Vulnerable › Vulnerabilities

CVE-2023-39264: Apache Superset: Stack traces enabled by default

• Severity: medium (CVSS 4.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.1% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-09-06 · updated 2026-06-17
• Weakness: CWE-209

Description

By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.

Affected products

• Apache Superset: through 2.1.0

References

• https://lists.apache.org/thread/y65t1of7hb445n86o1vdzjct7rfwlx75
• https://lists.apache.org/thread/y65t1of7hb445n86o1vdzjct7rfwlx75

Get alerted when CVE-2023-39264 or the next vulnerability affects your stack