Affected version lines
- 5.0 6 CVEs
- 4.1 13 CVEs
- 4.0 19 CVEs
- 3.1 25 CVEs
- 3.0 30 CVEs
- 2.1 44 CVEs
- 2.0 55 CVEs KEV 1
- 1.5 55 CVEs KEV 1
- 1.4 54 CVEs KEV 1
- 1.3 58 CVEs KEV 1
- 1.1 57 CVEs KEV 1
- 1.0 59 CVEs KEV 1
- 0.38 60 CVEs KEV 1
- 0.37 62 CVEs KEV 1
- 0.35 63 CVEs KEV 1
- 0.34 63 CVEs KEV 1
- 0.32 62 CVEs KEV 1
- 0.31 63 CVEs KEV 1
- 0.23 64 CVEs KEV 1
Known vulnerabilities
| CVE | Title | Affected versions | CVSS | Exploited | EPSS | Published |
|---|---|---|---|---|---|---|
| CVE-2023-27524 | Apache Superset: Session validation vulnerability when using provided default SECRET_KEY | ≤ 2.0.1 | 9.8 | KEV | 98.1% | 2023-04-24 |
| CVE-2026-23981 | Apache Superset: Improper Authorization in Chart Update allowing Dashboard Modification | < 6.0.0 | 5.3 | — | 2026-07-30 | |
| CVE-2026-23985 | Apache Superset: Regular Expression Denial of Service (ReDoS) in SQL Parser | ≥ 1.5.0 < 6.0.0 | 5.3 | — | 2026-07-30 | |
| CVE-2026-23983 | Apache Superset: Sensitive Data Exposure via REST API (disabled by default) | < 6.0.0 | 2.3 | — | 2026-02-24 | |
| CVE-2026-23984 | Apache Superset: SQLLab Read-Only Bypass on PostgreSQL | < 6.0.0 | 7.1 | — | 2026-02-24 | |
| CVE-2026-23969 | Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering | < 4.1.2 | 5.3 | — | 2026-02-24 | |
| CVE-2026-23980 | Apache Superset: Improper Neutralization of Special Elements used in a SQL Command | < 6.0.0 | 5.3 | — | 2026-02-24 | |
| CVE-2026-23982 | Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass | < 6.0.0 | 7.1 | — | 2026-02-24 | |
| CVE-2025-55672 | Apache Superset: Stored XSS on charts metadata | < 5.0.0 | 5.3 | — | 2025-08-14 | |
| CVE-2025-55673 | Apache Superset: Metadata exposure in embedded charts | < 4.1.3 | 5.3 | — | 2025-08-14 | |
| CVE-2025-55674 | Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions | < 5.0.0 | 5.3 | — | 2025-08-14 | |
| CVE-2025-55675 | Apache Superset: Incorrect datasource authorization on REST API | < 5.0.0 | 5.3 | — | 2025-08-14 | |
| CVE-2025-48912 | Apache Superset: Improper authorization bypass on row level security via SQL Injection | < 4.1.2 | 7.1 | — | 2025-05-30 | |
| CVE-2025-27696 | Apache Superset: Incorrect authorization leading to resource ownership takeover | < 4.1.2 | 5.3 | — | 2025-05-13 | |
| CVE-2024-55633 | Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access | < 4.1.0 | 7.1 | — | 2024-12-12 | |
| CVE-2024-53947 | Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions | < 4.1.0 | 2.3 | — | 2024-12-09 | |
| CVE-2024-53948 | Apache Superset: Error verbosity exposes metadata in analytics databases | < 4.1.0 | 5.3 | — | 2024-12-09 | |
| CVE-2024-53949 | Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled | ≥ 2.0.0 < 4.1.0 | 7.6 | — | 2024-12-09 | |
| CVE-2024-39887 | Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions | < 4.0.2 | 9.8 | — | 2024-07-16 | |
| CVE-2024-34693 | Apache Superset: Server arbitrary file read | < 3.1.3 ≥ 4.0.0 < 4.0.1 | 5.3 | — | 2024-06-20 | |
| CVE-2024-28148 | Apache Superset: Incorrect datasource authorization on explore REST API | < 4.0.0 | 4.3 | — | 2024-05-07 | |
| CVE-2024-24772 | Apache Superset: Improper Neutralisation of custom SQL on embedded context | < 3.0.4 ≥ 3.1.0 < 3.1.1 | 4.3 | — | 2024-02-28 | |
| CVE-2024-24773 | Apache Superset: Improper validation of SQL statements allows for unauthorized access to data | < 3.0.4 ≥ 3.1.0 < 3.1.1 | 6.5 | — | 2024-02-28 | |
| CVE-2024-24779 | Apache Superset: Improper data authorization when creating a new dataset | ≤ 3.0.4 ≥ 3.1.0 < 3.1.1 | 6.5 | — | 2024-02-28 | |
| CVE-2024-26016 | Apache Superset: Improper authorization validation on dashboards and charts import | < 3.0.4 ≥ 3.1.0 < 3.1.1 | 5.4 | — | 2024-02-28 | |
| CVE-2024-27315 | Apache Superset: Improper error handling on alerts | < 3.0.4 ≥ 3.1.0 < 3.1.1 | 4.3 | — | 2024-02-28 | |
| CVE-2024-23952 | Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb (version range fix for CVE-2023-4... | < 2.1.3 ≥ 3.0.0 < 3.0.2 | 6.5 | — | 2024-02-14 | |
| CVE-2023-49657 | Apache Superset: Stored XSS in Dashboard Title and Chart Title | < 3.0.3 | 5.4 | — | 2024-01-23 | |
| CVE-2023-49734 | Apache Superset: Privilege Escalation Vulnerability | < 2.1.2 ≥ 3.0.0 < 3.0.2 | 6.5 | — | 2023-12-19 | |
| CVE-2023-49736 | Apache Superset: SQL Injection on where_in JINJA macro | < 2.1.2 ≥ 3.0.0 < 3.0.2 | 8.8 | — | 2023-12-19 | |
| CVE-2023-46104 | Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb | < 2.1.3 ≥ 3.0.0 < 3.0.1 | 6.5 | — | 2023-12-19 | |
| CVE-2023-42504 | Apache Superset: Lack of rate limiting allows for possible denial of service | < 3.0.0 | 6.5 | — | 2023-11-28 | |
| CVE-2023-42505 | Apache Superset: Sensitive information disclosure on db connection details | < 3.0.0 | 4.3 | — | 2023-11-28 | |
| CVE-2023-42502 | Apache Superset: Open Redirect Vulnerability | < 3.0.0 | 5.4 | — | 2023-11-28 | |
| CVE-2023-40610 | Apache Superset: Privilege escalation with default examples database | < 2.1.2 | 8.8 | — | 2023-11-27 | |
| CVE-2023-42501 | Apache Superset: Unnecessary read permissions within the Gamma role | < 2.1.1 | 4.3 | — | 2023-11-27 | |
| CVE-2023-43701 | Apache Superset: Stored XSS on API endpoint | < 2.1.2 | 5.4 | — | 2023-11-27 | |
| CVE-2023-32672 | Apache Superset: SQL parser edge case bypasses data access authorization | ≤ 2.1.0 | 4.3 | — | 2023-09-06 | |
| CVE-2023-37941 | Apache Superset: Metadata db write access can lead to remote code execution | ≥ 1.5.0 ≤ 2.1.0 | 6.6 | — | 2023-09-06 | |
| CVE-2023-39265 | Apache Superset: Possible Unauthorized Registration of SQLite Database Connections | ≤ 2.1.0 | 6.5 | — | 2023-09-06 | |
| CVE-2023-36387 | Apache Superset: Improper API permission for low privilege users | * ≤ 2.1.0 | 5.4 | — | 2023-09-06 | |
| CVE-2023-27523 | Apache Superset: Improper data permission validation on Jinja templated queries | ≤ 2.1.0 | 4.3 | — | 2023-09-06 | |
| CVE-2023-27526 | Apache Superset: Improper Authorization check on import charts | ≤ 2.1.0 | 4.3 | — | 2023-09-06 | |
| CVE-2023-36388 | Apache Superset: Improper API permission for low privilege users allows for SSRF | ≤ 2.1.0 | 5.4 | — | 2023-09-06 | |
| CVE-2023-39264 | Apache Superset: Stack traces enabled by default | ≤ 2.1.0 | 4.3 | — | 2023-09-06 | |
| CVE-2023-30776 | Apache Superset: Database connection password leak | ≥ 1.3.0 ≤ 2.0.1 | 6.5 | — | 2023-04-24 | |
| CVE-2023-25504 | Apache Superset: Possible SSRF on import datasets | ≤ 2.0.1 | 6.5 | — | 2023-04-17 | |
| CVE-2023-27525 | Apache Superset: Incorrect default permissions for Gamma role | ≤ 2.0.1 | 4.3 | — | 2023-04-17 | |
| CVE-2022-41703 | Apache Superset: SQL injection vulnerability in adhoc clauses | ≤ 1.5.2 = 2.0.0 | 5.4 | — | 2023-01-16 | |
| CVE-2022-43717 | Apache Superset: Cross-Site Scripting on dashboards | ≤ 1.5.2 = 2.0.0 | 5.4 | — | 2023-01-16 | |
| CVE-2022-43718 | Apache Superset: Cross-Site Scripting vulnerability on upload forms | ≤ 1.5.2 = 2.0.0 | 5.4 | — | 2023-01-16 | |
| CVE-2022-43719 | Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API | ≤ 1.5.2 = 2.0.0 | 8.8 | — | 2023-01-16 | |
| CVE-2022-43720 | Apache Superset: Improper rendering of user input | ≤ 1.5.2 = 2.0.0 | 5.4 | — | 2023-01-16 | |
| CVE-2022-43721 | Apache Superset: Open Redirect Vulnerability | ≤ 1.5.2 = 2.0.0 | 5.4 | — | 2023-01-16 | |
| CVE-2022-45438 | Apache Superset: Dashboard metadata information leak | ≤ 1.5.2 = 2.0.0 | 5.3 | — | 2023-01-16 | |
| CVE-2021-37839 | Improper access to dataset metadata information | ≤ 1.5.1 | 4.3 | — | 2022-07-06 | |
| CVE-2022-27479 | SQL injection vulnerability in chart data API | < 1.4.2 | 9.8 | — | 2022-04-13 | |
| CVE-2021-44451 | API sensitive information leak | ≤ 1.3.2 | 6.5 | — | 2022-02-01 | |
| CVE-2021-42250 | Possible log injection | < 1.3.2 | 6.5 | — | 2021-11-17 | |
| CVE-2021-41972 | Credentials leak | ≤ 1.3.1 | 6.5 | — | 2021-11-12 |
Track these versions on your own servers
InfraGuard collects installed software versions from every server and flags the ones with known vulnerabilities. Self-hosted — nothing leaves your network.
Data: CVE List (CVE® Program), NVD, CISA KEV, FIRST EPSS (see EPSS at https://www.first.org/epss), endoflife.date. Software list: awesome-selfhosted (CC BY-SA 3.0).