SU
Product
Superset
On CISA KEVExploited in the wild
70
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 5High 7Medium 58Low 0
Watch
Add Superset to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-27524 In wildKEV | 9.8 | Apr 24 | Apache Superset: Session validation vulnerability when using provided default SECRET_KEY Affected: through 2.0.1 |
| CVE-2024-53947 | 9.8 | Dec 9 | Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions Affected: before 4.1.0 |
| CVE-2024-39887 | 9.8 | Jul 16 | Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions Affected: before 4.0.2 |
| CVE-2022-27479 | 9.8 | Apr 13 | SQL injection vulnerability in chart data API Affected: before 1.4.2 |
| CVE-2018-8021 | 9.8 | Nov 7 | Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to possible remote code execution Affected: before 0.23 |
| CVE-2025-27696 | 8.8 | May 13 | Apache Superset: Incorrect authorization leading to resource ownership takeover Affected: before 4.1.2 |
| CVE-2023-49736 | 8.8 | Dec 19 | Apache Superset: SQL Injection on where_in JINJA macro Affected: before 2.1.2; 3.0.0 before 3.0.2 |
| CVE-2023-40610 | 8.8 | Nov 27 | Apache Superset: Privilege escalation with default examples database Affected: before 2.1.2 |
| CVE-2022-43719 | 8.8 | Jan 16 | Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API Affected: through 1.5.2; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2021-41971 | 8.8 | Oct 18 | Possible SQL Injection when template processing is enabled Affected: through 1.3.0 |
| CVE-2020-13948 | 8.8 | Sep 17 | While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of templated text fields in the product that… Affected: before 0.37.1 |
| CVE-2020-13952 | 8.1 | Sep 30 | In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a… Affected: before 0.37.2 |
| CVE-2023-37941 | 6.6 | Sep 6 | Apache Superset: Metadata db write access can lead to remote code execution Affected: 1.5.0 through 2.1.0 |
| CVE-2026-23985 | 6.5 | Jul 30 | Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser Affected: 1.5.0 before 6.0.0 |
| CVE-2026-23969 | 6.5 | Feb 24 | Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering Affected: before 4.1.2 |
| CVE-2026-23980 | 6.5 | Feb 24 | Apache Superset: Improper Neutralization of Special Elements used in a SQL Command Affected: before 6.0.0 |
| CVE-2026-23982 | 6.5 | Feb 24 | Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass Affected: before 6.0.0 |
| CVE-2026-23983 | 6.5 | Feb 24 | Apache Superset: Sensitive Data Exposure via REST API (disabled by default) Affected: before 6.0.0 |
| CVE-2026-23984 | 6.5 | Feb 24 | Apache Superset: SQLLab Read-Only Bypass on PostgreSQL Affected: before 6.0.0 |
| CVE-2025-55675 | 6.5 | Aug 14 | Apache Superset: Incorrect datasource authorization on REST API Affected: before 5.0.0 |
| CVE-2025-55674 | 6.5 | Aug 14 | Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions Affected: before 5.0.0 |
| CVE-2025-48912 | 6.5 | May 30 | Apache Superset: Improper authorization bypass on row level security via SQL Injection Affected: before 4.1.2 |
| CVE-2024-55633 | 6.5 | Dec 12 | Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access Affected: before 4.1.0 |
| CVE-2024-53949 | 6.5 | Dec 9 | Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled Affected: 2.0.0 before 4.1.0 |
| CVE-2024-24779 | 6.5 | Feb 28 | Apache Superset: Improper data authorization when creating a new dataset Affected: through 3.0.4; 3.1.0 before 3.1.1 |
| CVE-2024-24773 | 6.5 | Feb 28 | Apache Superset: Improper validation of SQL statements allows for unauthorized access to data Affected: before 3.0.4; 3.1.0 before 3.1.1 |
| CVE-2024-23952 | 6.5 | Feb 14 | Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104) Affected: before 2.1.3; 3.0.0 before 3.0.2 |
| CVE-2023-49734 | 6.5 | Dec 19 | Apache Superset: Privilege Escalation Vulnerability Affected: before 2.1.2; 3.0.0 before 3.0.2 |
| CVE-2023-46104 | 6.5 | Dec 19 | Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb Affected: before 2.1.3; 3.0.0 before 3.0.1 |
| CVE-2023-42504 | 6.5 | Nov 28 | Apache Superset: Lack of rate limiting allows for possible denial of service Affected: before 3.0.0 |
| CVE-2023-39265 | 6.5 | Sep 6 | Apache Superset: Possible Unauthorized Registration of SQLite Database Connections Affected: through 2.1.0 |
| CVE-2023-30776 | 6.5 | Apr 24 | Apache Superset: Database connection password leak Affected: 1.3.0 through 2.0.1 |
| CVE-2023-25504 | 6.5 | Apr 17 | Apache Superset: Possible SSRF on import datasets Affected: through 2.0.1 |
| CVE-2021-44451 | 6.5 | Feb 1 | API sensitive information leak Affected: through 1.3.2 |
| CVE-2021-42250 | 6.5 | Nov 17 | Possible log injection Affected: before 1.3.2 |
| CVE-2021-41972 | 6.5 | Nov 12 | Credentials leak Affected: through 1.3.1 |
| CVE-2020-1932 | 6.5 | Jan 28 | An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1 Affected: 0.34.0; 0.34.1; 0.35.0; 0.35.1 |
| CVE-2021-28125 | 6.1 | Apr 27 | Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious Affected: through 1.0.1 |
| CVE-2025-55672 | 5.4 | Aug 14 | Apache Superset: Stored XSS on charts metadata Affected: before 5.0.0 |
| CVE-2024-26016 | 5.4 | Feb 28 | Apache Superset: Improper authorization validation on dashboards and charts import Affected: before 3.0.4; 3.1.0 before 3.1.1 |
| CVE-2023-49657 | 5.4 | Jan 23 | Apache Superset: Stored XSS in Dashboard Title and Chart Title Affected: before 3.0.3 |
| CVE-2023-42502 | 5.4 | Nov 28 | Apache Superset: Open Redirect Vulnerability Affected: before 3.0.0 |
| CVE-2023-43701 | 5.4 | Nov 27 | Apache Superset: Stored XSS on API endpoint Affected: before 2.1.2 |
| CVE-2023-36388 | 5.4 | Sep 6 | Apache Superset: Improper API permission for low privilege users allows for SSRF Affected: through 2.1.0 |
| CVE-2023-36387 | 5.4 | Sep 6 | Apache Superset: Improper API permission for low privilege users Affected: through 2.1.0 |
| CVE-2022-41703 | 5.4 | Jan 16 | Apache Superset: SQL injection vulnerability in adhoc clauses Affected: through 1.5.2; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2022-43721 | 5.4 | Jan 16 | Apache Superset: Open Redirect Vulnerability Affected: through 1.5.2; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2022-43720 | 5.4 | Jan 16 | Apache Superset: Improper rendering of user input Affected: through 1.5.2; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2022-43718 | 5.4 | Jan 16 | Apache Superset: Cross-Site Scripting vulnerability on upload forms Affected: through 1.5.2; 2.0.0; 2.0.0; 2.0.0 |
| CVE-2022-43717 | 5.4 | Jan 16 | Apache Superset: Cross-Site Scripting on dashboards Affected: through 1.5.2; 2.0.0; 2.0.0; 2.0.0 |