SU
Product
Superset
On CISA KEVExploited in the wild
70
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 7Medium 58Low 0
Watch
Add Superset to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-27524 In wildKEV | 9.8 | Apr 24 | Apache Superset: Session validation vulnerability when using provided default SECRET_KEY Affected: through 2.0.1 |
| CVE-2024-53947 | 9.8 | Dec 9 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset Affected: before 4.1.0 |
| CVE-2024-39887 | 9.8 | Jul 16 | An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands Affected: before 4.0.2 |
| CVE-2022-27479 | 9.8 | Apr 13 | Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests Affected: before 1.4.2 |
| CVE-2018-8021 | 9.8 | Nov 7 | Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution Affected: before 0.23 |
| CVE-2025-27696 | 8.8 | May 13 | Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by authenticated users with read permissions Affected: before 4.1.2 |
| CVE-2023-49736 | 8.8 | Dec 19 | A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow for SQL injection in Apache Superset.This issue affects… Affected: before 2.1.2; 3.0.0 before 3.0.2 |
| CVE-2023-40610 | 8.8 | Nov 27 | Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2 Affected: before 2.1.2 |
| CVE-2022-43719 | 8.8 | Jan 16 | Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery Affected: through 1.5.2; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2021-41971 | 8.8 | Oct 18 | Apache Superset up to and including 1.3.0 when configured with ENABLE_TEMPLATE_PROCESSING on (disabled by default) allowed SQL injection when a malicious authenticated user sends… Affected: through 1.3.0 |
| CVE-2020-13948 | 8.8 | Sep 17 | While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templated text fields in the product that… Affected: before 0.37.1 |
| CVE-2020-13952 | 8.1 | Sep 30 | In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a… Affected: before 0.37.2 |
| CVE-2023-37941 | 6.6 | Sep 6 | If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on… Affected: 1.5.0 through 2.1.0 |
| CVE-2026-23985 | 6.5 | Jul 30 | Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser Affected: 1.5.0 before 6.0.0 |
| CVE-2026-23984 | 6.5 | Feb 24 | An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a… Affected: before 6.0.0 |
| CVE-2026-23983 | 6.5 | Feb 24 | A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information Affected: before 6.0.0 |
| CVE-2026-23982 | 6.5 | Feb 24 | An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls Affected: before 6.0.0 |
| CVE-2026-23980 | 6.5 | Feb 24 | Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct… Affected: before 6.0.0 |
| CVE-2026-23969 | 6.5 | Feb 24 | Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts Affected: before 4.1.2 |
| CVE-2025-55675 | 6.5 | Aug 14 | Apache Superset contains an improper access control vulnerability in its /explore endpoint Affected: before 5.0.0 |
| CVE-2025-55674 | 6.5 | Aug 14 | A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions Affected: before 5.0.0 |
| CVE-2025-48912 | 6.5 | May 30 | An authenticated malicious actor using specially crafted requests could bypass row level security configuration by injecting SQL into 'sqlExpression' fields Affected: before 4.1.2 |
| CVE-2024-55633 | 6.5 | Dec 12 | Improper Authorization vulnerability in Apache Superset Affected: before 4.1.0 |
| CVE-2024-53949 | 6.5 | Dec 9 | Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default) Affected: 2.0.0 before 4.1.0 |
| CVE-2024-24779 | 6.5 | Feb 28 | Apache Superset with custom roles that include `can write on dataset` and without all data access permissions, allows for users to create virtual datasets to data they don't have… Affected: through 3.0.4; 3.1.0 before 3.1.1 |
| CVE-2024-24773 | 6.5 | Feb 28 | Improper parsing of nested SQL statements on SQLLab would allow authenticated users to surpass their data authorization scope Affected: before 3.0.4; 3.1.0 before 3.1.1 |
| CVE-2024-23952 | 6.5 | Feb 14 | This is a duplicate for CVE-2023-46104 Affected: before 2.1.3; 3.0.0 before 3.0.2 |
| CVE-2023-49734 | 6.5 | Dec 19 | An authenticated Gamma user has the ability to create a dashboard and add charts to it, this user would automatically become one of the owners of the charts allowing him to… Affected: before 2.1.2; 3.0.0 before 3.0.2 |
| CVE-2023-46104 | 6.5 | Dec 19 | Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists… Affected: before 2.1.3; 3.0.0 before 3.0.1 |
| CVE-2023-42504 | 6.5 | Nov 28 | An authenticated malicious user could initiate multiple concurrent requests, each requesting multiple dashboard exports, leading to a possible denial of service Affected: before 3.0.0 |
| CVE-2023-39265 | 6.5 | Sep 6 | Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternative driver names like sqlite+pysqlite or by using database… Affected: through 2.1.0 |
| CVE-2023-30776 | 6.5 | Apr 24 | An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects Apache Superset… Affected: 1.3.0 through 2.0.1 |
| CVE-2023-25504 | 6.5 | Apr 17 | A malicious actor who has been authenticated and granted specific permissions in Apache Superset may use the import dataset feature in order to conduct Server-Side Request Forgery… Affected: through 2.0.1 |
| CVE-2021-44451 | 6.5 | Feb 1 | Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users Affected: through 1.3.2 |
| CVE-2021-42250 | 6.5 | Nov 17 | Improper output neutralization for Logs Affected: before 1.3.2 |
| CVE-2021-41972 | 6.5 | Nov 12 | Apache Superset up to and including 1.3.1 allowed for database connections password leak for authenticated users Affected: through 1.3.1 |
| CVE-2020-1932 | 6.5 | Jan 28 | An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1 Affected: 0.34.0; 0.34.1; 0.35.0; 0.35.1 |
| CVE-2021-28125 | 6.1 | Apr 27 | Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious Affected: through 1.0.1 |
| CVE-2025-55672 | 5.4 | Aug 14 | A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization Affected: before 5.0.0 |
| CVE-2024-26016 | 5.4 | Feb 28 | A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the… Affected: before 3.0.4; 3.1.0 before 3.1.1 |
| CVE-2023-49657 | 5.4 | Jan 23 | A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker with create/update permissions on charts or dashboards could… Affected: before 3.0.3 |
| CVE-2023-42502 | 5.4 | Nov 28 | An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site… Affected: before 3.0.0 |
| CVE-2023-43701 | 5.4 | Nov 27 | Improper payload validation and an improper REST API response type, made it possible for an authenticated malicious actor to store malicious code into Chart's metadata, this code… Affected: before 2.1.2 |
| CVE-2023-36388 | 5.4 | Sep 6 | Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF Affected: through 2.1.0 |
| CVE-2023-36387 | 5.4 | Sep 6 | An improper default REST API permission for Gamma users in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma user to test database connections Affected: through 2.1.0 |
| CVE-2022-43721 | 5.4 | Jan 16 | An authenticated attacker with update datasets permission could change a dataset link to an untrusted site, users could be redirected to this site when clicking on that specific… Affected: through 1.5.2; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2022-43720 | 5.4 | Jan 16 | An authenticated attacker with write CSS template permissions can create a record with specific HTML tags that will not get properly escaped by the toast message displayed when a… Affected: through 1.5.2; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2022-43718 | 5.4 | Jan 16 | Upload data forms do not correctly render user input leading to possible XSS attack vectors that can be performed by authenticated users with database connection update… Affected: through 1.5.2; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2022-43717 | 5.4 | Jan 16 | Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with… Affected: through 1.5.2; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2022-41703 | 5.4 | Jan 16 | A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING… Affected: through 1.5.2; 2.0.0; 2.0.0; 2.0.0 |