Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Apache Superset — Vulnerabilities & Security Advisories 67

All 67 CVE vulnerabilities found in Apache Superset, with AI-generated Chinese analysis, references, and POCs.

This page aggregates recorded security vulnerabilities affecting Apache Superset, an open-source business intelligence platform maintained by the Apache Software Foundation. The collection focuses on known flaws including authentication bypasses, cross-site scripting, and remote code execution issues, covering advisories published from the project’s initial release through the current stable version. Here, you can track the vendor’s security advisory history, analyze the distribution of specific weakness classes like injection or improper input validation, and review the product’s complete vulnerability timeline without being distracted by marketing language or individual CVE listings.

Vendor: Apache Software Foundation

CVE ID Title CVSS Severity Published
CVE-2026-23985 Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser CWE-1333 5.3 Medium 2026-07-30
CVE-2026-23981 Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification CWE-285 5.3 Medium 2026-07-30
CVE-2026-23969 Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering CWE-89 9.8 - 2026-02-24
CVE-2026-23980 Apache Superset: Improper Neutralization of Special Elements used in a SQL Command CWE-89 8.8 - 2026-02-24
CVE-2026-23982 Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass CWE-863 6.5 - 2026-02-24
CVE-2026-23983 Apache Superset: Sensitive Data Exposure via REST API (disabled by default) CWE-200 6.5 - 2026-02-24
CVE-2026-23984 Apache Superset: SQLLab Read-Only Bypass on PostgreSQL CWE-863 8.1 - 2026-02-24
CVE-2025-55675 Apache Superset: Incorrect datasource authorization on REST API CWE-285 4.3AI Medium AI 2025-08-14
CVE-2025-55674 Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions CWE-89 6.5AI Medium AI 2025-08-14
CVE-2025-55672 Apache Superset: Stored XSS on charts metadata CWE-80 5.4AI Medium AI 2025-08-14
CVE-2025-55673 Apache Superset: Metadata exposure in embedded charts CWE-200 3.5AI Low AI 2025-08-14
CVE-2025-48912 Apache Superset: Improper authorization bypass on row level security via SQL Injection CWE-89 6.5AI Medium AI 2025-05-30
CVE-2025-27696 Apache Superset: Incorrect authorization leading to resource ownership takeover CWE-863 6.5AI Medium AI 2025-05-13
CVE-2024-55633 Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access CWE-863 8.8 - 2024-12-12
CVE-2024-53949 Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled CWE-863 8.8 - 2024-12-09
CVE-2024-53948 Apache Superset: Error verbosity exposes metadata in analytics databases CWE-209 5.3 - 2024-12-09
CVE-2024-53947 Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions CWE-89 9.8 - 2024-12-09
CVE-2024-39887 Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions CWE-89 4.3 Medium 2024-07-16
CVE-2024-34693 Apache Superset: Server arbitrary file read CWE-20 6.8 Medium 2024-06-20
CVE-2024-28148 Apache Superset: Incorrect datasource authorization on explore REST API CWE-863 4.3 Medium 2024-05-07
CVE-2024-26016 Apache Superset: Improper authorization validation on dashboards and charts import CWE-863 4.3 Medium 2024-02-28
CVE-2024-24779 Apache Superset: Improper data authorization when creating a new dataset CWE-863 5.0 Medium 2024-02-28
CVE-2024-24772 Apache Superset: Improper Neutralisation of custom SQL on embedded context CWE-89 4.3 Medium 2024-02-28
CVE-2024-24773 Apache Superset: Improper validation of SQL statements allows for unauthorized access to data CWE-863 4.9 Medium 2024-02-28
CVE-2024-27315 Apache Superset: Improper error handling on alerts CWE-209 4.3 Medium 2024-02-28
CVE-2024-23952 Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-46104) CWE-400 6.5 Medium 2024-02-14
CVE-2023-49657 Apache Superset: Stored XSS in Dashboard Title and Chart Title CWE-79 9.6 Critical 2024-01-23
CVE-2023-49734 Apache Superset: Privilege Escalation Vulnerability CWE-863 7.7 High 2023-12-19
CVE-2023-49736 Apache Superset: SQL Injection on where_in JINJA macro CWE-89 6.5 Medium 2023-12-19
CVE-2023-46104 Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb CWE-400 6.5 Medium 2023-12-19

All 67 known CVE vulnerabilities affecting Apache Superset with full Chinese analysis, references, and POCs where available.