Apache
Apache Superset: vulnerabilidades y CVE
Apache Superset tiene 70 vulnerabilidades publicadas, 7 de ellas en los últimos 12 meses. 4 son críticas y 1 figuran en el catálogo de explotación activa de CISA.
CVE70
Últimos 12 meses7
Críticas4
Explotadas activamente1
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2023-27524 | Crítica (9.8) | 97% | ⚠ Explotación activa | 24 abr 2023 | Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to… |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-23985 | Media (5.3) | 0.65% | — | 30 jul 2026 | A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql_parse.py component, specifically within the SQL_REGEX used for… |
| CVE-2026-23981 | Media (5.3) | 0.56% | — | 30 jul 2026 | An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST… |
| CVE-2026-23984 | Alta (7.1) | 0.36% | — | 24 feb 2026 | An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the… |
| CVE-2026-23983 | Baja (2.3) | 0.42% | — | 24 feb 2026 | A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects… |
| CVE-2026-23982 | Alta (7.1) | 0.45% | — | 24 feb 2026 | An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from… |
| CVE-2026-23980 | Media (5.3) | 0.65% | — | 24 feb 2026 | Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the… |
| CVE-2026-23969 | Media (5.3) | 0.62% | — | 24 feb 2026 | Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for… |
| CVE-2025-55675 | Media (5.3) | 0.53% | — | 14 ago 2025 | Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows an authenticated user to discover metadata about datasources they do not have permission… |
| CVE-2025-55674 | Media (5.3) | 0.69% | — | 14 ago 2025 | A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user… |
| CVE-2025-55673 | Media (5.3) | 0.57% | — | 14 ago 2025 | When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database… |
| CVE-2025-55672 | Media (5.3) | 0.74% | — | 14 ago 2025 | A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with permissions to edit charts can inject a malicious payload into a column's label. The payload… |
| CVE-2025-48912 | Alta (7.1) | 0.72% | — | 30 may 2025 | An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields. This allowed the execution of sub-queries to evade parsing… |
| CVE-2025-27696 | Media (5.3) | 1.2% | — | 13 may 2025 | Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions. This issue affects Apache Superset: through 4.1.1. Users… |
| CVE-2024-55633 | Alta (7.1) | 2.8% | — | 12 dic 2024 | Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only… |
| CVE-2024-53949 | Alta (7.6) | 0.72% | — | 9 dic 2024 | Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Allows for lower privilege users to use this API. issue affects Apache Superset: from 2.0.0 before… |
| CVE-2024-53948 | Media (5.3) | 0.85% | — | 9 dic 2024 | Generation of Error Message Containing analytics metadata Information in Apache Superset. This issue affects Apache Superset: before 4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue. |
| CVE-2024-53947 | Baja (2.3) | 0.84% | — | 9 dic 2024 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass… |
| CVE-2024-39887 | Crítica (9.8) | 4.4% | — | 16 jul 2024 | An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers… |
| CVE-2024-34693 | Media (5.3) | 1.6% | — | 20 jun 2024 | Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql… |
| CVE-2024-28148 | Media (4.3) | 0.70% | — | 7 may 2024 | An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request.This issue affects Apache Superset: before 3.1.2. Users are recommended… |
| CVE-2024-26016 | Media (5.4) | 0.87% | — | 28 feb 2024 | A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that… |
| CVE-2024-24779 | Media (6.5) | 0.73% | — | 28 feb 2024 | Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create virtual datasets to data they don't have access to. These users could then use… |
| CVE-2024-24773 | Media (6.5) | 0.78% | — | 28 feb 2024 | Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope. This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1. Users are… |
| CVE-2024-24772 | Media (4.3) | 0.95% | — | 28 feb 2024 | A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0… |
| CVE-2024-27315 | Media (4.3) | 0.98% | — | 28 feb 2024 | An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by… |
| CVE-2024-23952 | Media (6.5) | 1.7% | — | 14 feb 2024 | This is a duplicate for CVE-2023-46104. With correct CVE version ranges for affected Apache Superset. Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import… |
| CVE-2023-49657 | Media (5.4) | 0.84% | — | 23 ene 2024 | A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could store a script or add a specific HTML… |
| CVE-2023-49736 | Alta (8.8) | 1.2% | — | 19 dic 2023 | A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects Apache Superset: before 2.1.2, from 3.0.0… |
| CVE-2023-49734 | Media (6.5) | 0.95% | — | 19 dic 2023 | An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to incorrectly have write permissions to these… |
| CVE-2023-46104 | Media (6.5) | 1.7% | — | 19 dic 2023 | Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.