# apache-superset (PyPI) vulnerabilities

66 known vulnerabilities (1 critical, 8 high, 39 medium, 4 low), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 6.1.0 (May 13, 2026): no advisory affects it
- Newest unaffected release: 6.1.0 (May 13, 2026), the latest release
- Weekly downloads: 110.4K
- Dependents: 4
- Releases: 83 since 0.34.0 (Sep 18, 2019)
- Registry: https://pypi.org/project/apache-superset/
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2026-23969: 0.34.0 to 4.1.2rc1 (4.1.2 is outside it)
- CVE-2026-23980: 0.34.0 to 6.0.0rc4 (6.0.0 is outside it)
- CVE-2026-23982: 0.34.0 to 6.0.0rc4 (6.0.0 is outside it)
- CVE-2026-23983: 0.34.0 to 6.0.0rc4 (6.0.0 is outside it)
- CVE-2026-23984: 0.34.0 to 6.0.0rc4 (6.0.0 is outside it)
- CVE-2025-55675: 0.34.0 to 5.0.0rc4 (5.0.0 is outside it)
- CVE-2025-55674: 0.34.0 to 5.0.0rc4 (5.0.0 is outside it)
- CVE-2025-55672: 0.34.0 to 5.0.0rc4 (5.0.0 is outside it)
- CVE-2025-55673: 0.34.0 to 4.1.3rc2 (4.1.3.post1 is outside it)
- CVE-2025-48912: 0.34.0 to 4.1.2rc1 (4.1.2 is outside it)
- CVE-2025-27696: 0.34.0 to 4.1.2rc1 (4.1.2 is outside it)
- CVE-2024-55633: 0.34.0 to 4.1.0rc4 (4.1.0 is outside it)
- CVE-2024-53949: 2.0.0 to 4.1.0rc4 (4.1.0 is outside it)
- CVE-2024-53948: 0.34.0 to 4.1.0rc4 (4.1.0 is outside it)
- CVE-2024-53947: 0.34.0 to 4.1.0rc4 (4.1.0 is outside it)
- CVE-2024-39887: 0.34.0 to 4.0.1 (4.0.2 is outside it)
- CVE-2024-34693: 0.34.0 to 3.1.2 (3.1.3 is outside it); 4.0.0 (4.0.1 is outside it)
- CVE-2024-28148: 0.34.0 to 3.1.1 (3.1.2 is outside it)
- CVE-2024-26016: 0.34.0 to 3.0.3 (3.0.4 is outside it); 3.1.0 (3.1.1 is outside it)
- CVE-2024-24779: 0.34.0 to 3.0.3 (3.0.4 is outside it); 3.1.0 (3.1.1 is outside it)
- CVE-2024-24772: 0.34.0 to 3.0.3 (3.0.4 is outside it); 3.1.0 (3.1.1 is outside it)
- CVE-2024-24773: 0.34.0 to 3.0.3 (3.0.4 is outside it); 3.1.0 (3.1.1 is outside it)
- CVE-2024-27315: 0.34.0 to 3.0.3 (3.0.4 is outside it); 3.1.0 (3.1.1 is outside it)
- CVE-2023-49657: 0.34.0 to 3.0.2 (3.0.3 is outside it)
- CVE-2023-49734: 0.34.0 to 2.1.2 (2.1.3 is outside it); 3.0.0 to 3.0.1 (3.0.2 is outside it)
- CVE-2023-49736: 0.34.0 to 2.1.2 (2.1.3 is outside it); 3.0.0 to 3.0.1 (3.0.2 is outside it)
- CVE-2023-46104: 0.34.0 to 2.1.1 (2.1.2 is outside it); 3.0.0 to 3.0.4 (3.1.0rc1 is outside it)
- CVE-2023-42504: 0.34.0 to 3.0.0rc4 (3.0.0 is outside it)
- CVE-2023-42505: 0.34.0 to 3.0.0rc4 (3.0.0 is outside it)
- CVE-2023-42502: 0.34.0 to 3.0.0rc4 (3.0.0 is outside it)
- CVE-2023-43701: 0.34.0 to 2.1.1 (2.1.2 is outside it)
- CVE-2023-42501: 0.34.0 to 2.1.1 (2.1.2 is outside it)
- CVE-2023-40610: 0.34.0 to 2.1.1 (2.1.2 is outside it)
- CVE-2023-32672: 0.34.0 to 2.1.1rc3 (2.1.1 is outside it)
- CVE-2023-37941: 1.5.0 to 2.1.1rc3 (2.1.1 is outside it)
- CVE-2023-39265: 0.34.0 to 2.1.1rc3 (2.1.1 is outside it)
- CVE-2023-39264: 0.34.0 to 2.1.1rc3 (2.1.1 is outside it)
- CVE-2023-27523: 0.34.0 to 2.1.1rc3 (2.1.1 is outside it)
- CVE-2023-36388: 0.34.0 to 2.1.1rc3 (2.1.1 is outside it)
- CVE-2023-27526: 0.34.0 to 2.1.1rc3 (2.1.1 is outside it)
- CVE-2023-36387: 0.34.0 to 2.1.0 (2.1.1rc1 is outside it)
- CVE-2023-30776: 1.3.0 to 2.0.1 (2.1.0 is outside it)
- CVE-2023-27524: 0.34.0 to 2.0.1 (2.1.0 is outside it)
- CVE-2023-25504: 0.34.0 to 2.0.1 (2.1.0 is outside it)
- CVE-2023-27525: 0.34.0 to 2.0.1 (2.1.0 is outside it)
- CVE-2022-41703: 0.34.0 to 1.5.2 (1.5.3 is outside it); 2.0.0 (2.0.1 is outside it)
- CVE-2022-45438: 0.34.0 to 1.5.2 (1.5.3 is outside it); 2.0.0 (2.0.1 is outside it)
- CVE-2022-43721: 0.34.0 to 1.5.2 (1.5.3 is outside it); 2.0.0 (2.0.1 is outside it)
- CVE-2022-43720: 0.34.0 to 1.5.2 (1.5.3 is outside it); 2.0.0 (2.0.1 is outside it)
- CVE-2022-43719: 0.34.0 to 1.5.2 (1.5.3 is outside it); 2.0.0 (2.0.1 is outside it)
- CVE-2022-43718: 0.34.0 to 1.5.2 (1.5.3 is outside it); 2.0.0 (2.0.1 is outside it)
- CVE-2022-43717: 0.34.0 to 1.5.2 (1.5.3 is outside it); 2.0.0 (2.0.1 is outside it)
- CVE-2021-37839: 0.34.0 to 1.5.0 (1.5.1 is outside it)
- CVE-2022-27479: 0.34.0 to 1.4.1 (1.4.2 is outside it)
- CVE-2021-44451: 0.34.0 to 1.3.2 (1.4.0 is outside it)
- CVE-2021-42250: 0.34.0 to 1.3.1 (1.3.2 is outside it)
- CVE-2021-41972: 0.34.0 to 1.3.1 (1.3.2 is outside it)
- CVE-2021-41971: 0.34.0 to 1.3.0 (1.3.1 is outside it)
- CVE-2021-32609: 0.34.0 to 1.1.0 (1.2.0 is outside it)
- CVE-2021-28125: 0.34.0 to 1.0.1 (1.1.0 is outside it)
- CVE-2021-27907: 0.34.0 to 0.38.0 (0.38.1 is outside it)
- CVE-2020-13952: 0.34.0 to 0.37.1 (0.37.2 is outside it)
- CVE-2020-13948: 0.34.0 to 0.37.0 (0.37.1 is outside it)
- CVE-2020-1932: 0.34.0 to 0.35.1 (0.35.2 is outside it)
- CVE-2019-12413: no published release is affected
- CVE-2019-12414: no published release is affected

## Advisories (66)

### [CVE-2026-23969](https://cve.now/CVE-2026-23969): Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 4.1.2.
- Fixed in 4.1.2 (released Mar 24, 2025, 337 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2026-23980](https://cve.now/CVE-2026-23980): Apache Superset: Improper Neutralization of Special Elements used in a SQL Command

- Severity: Medium 5.3
- Published: Feb 24, 2026
- Affected: fixed in 6.0.0.
- Fixed in 6.0.0 (released Dec 18, 2025, 68 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2026-23982](https://cve.now/CVE-2026-23982): Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass

- Severity: High 7.1
- Published: Feb 24, 2026
- Affected: fixed in 6.0.0.
- Fixed in 6.0.0 (released Dec 18, 2025, 68 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2026-23983](https://cve.now/CVE-2026-23983): Apache Superset: Sensitive Data Exposure via REST API (disabled by default)

- Severity: Low 2.3
- Published: Feb 24, 2026
- Affected: fixed in 6.0.0.
- Fixed in 6.0.0 (released Dec 18, 2025, 68 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2026-23984](https://cve.now/CVE-2026-23984): Apache Superset: SQLLab Read-Only Bypass on PostgreSQL

- Severity: High 7.1
- Published: Feb 24, 2026
- Affected: fixed in 6.0.0.
- Fixed in 6.0.0 (released Dec 18, 2025, 68 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2025-55675](https://cve.now/CVE-2025-55675): Apache Superset: Incorrect datasource authorization on REST API

- Severity: Medium 5.3
- Published: Aug 14, 2025
- Affected: fixed in 5.0.0.
- Fixed in 5.0.0 (released Jun 23, 2025, 52 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2025-55674](https://cve.now/CVE-2025-55674): Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions

- Severity: Medium 5.3
- Published: Aug 14, 2025
- Affected: fixed in 5.0.0.
- Fixed in 5.0.0 (released Jun 23, 2025, 52 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2025-55672](https://cve.now/CVE-2025-55672): Apache Superset: Stored XSS on charts metadata

- Severity: Medium 5.3
- Published: Aug 14, 2025
- Affected: fixed in 5.0.0.
- Fixed in 5.0.0 (released Jun 23, 2025, 52 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2025-55673](https://cve.now/CVE-2025-55673): Apache Superset: Metadata exposure in embedded charts

- Severity: Medium 5.3
- Published: Aug 14, 2025
- Affected: fixed in 4.1.3.post1.
- Fixed in 4.1.3.post1 (released Jul 17, 2025, 28 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2025-48912](https://cve.now/CVE-2025-48912): Apache Superset: Improper authorization bypass on row level security via SQL Injection

- Severity: High 7.1
- Published: May 30, 2025
- Affected: fixed in 4.1.2.
- Fixed in 4.1.2 (released Mar 24, 2025, 67 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2025-27696](https://cve.now/CVE-2025-27696): Apache Superset: Incorrect authorization leading to resource ownership takeover

- Severity: Medium 5.3
- Published: May 13, 2025
- Affected: fixed in 4.1.2.
- Fixed in 4.1.2 (released Mar 24, 2025, 50 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2024-55633](https://cve.now/CVE-2024-55633): Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

- Severity: High 7.1
- Published: Dec 12, 2024
- Affected: fixed in 4.1.0.
- Fixed in 4.1.0 (released Nov 13, 2024, 29 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2024-53949](https://cve.now/CVE-2024-53949): Apache Superset: Lower privilege users are able to create Role when FAB\_ADD\_SECURITY\_API is enabled

- Severity: High 7.6
- Published: Dec 9, 2024
- Affected: from 2.0.0, fixed in 4.1.0.
- Fixed in 4.1.0 (released Nov 13, 2024, 26 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2024-53948](https://cve.now/CVE-2024-53948): Apache Superset: Error verbosity exposes metadata in analytics databases

- Severity: Medium 5.3
- Published: Dec 9, 2024
- Affected: fixed in 4.1.0.
- Fixed in 4.1.0 (released Nov 13, 2024, 26 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2024-53947](https://cve.now/CVE-2024-53947): Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions

- Severity: Low 2.3
- Published: Dec 9, 2024
- Affected: fixed in 4.1.0.
- Fixed in 4.1.0 (released Nov 13, 2024, 26 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2024-39887](https://cve.now/CVE-2024-39887): Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions

- Severity: Medium 4.3
- Published: Jul 16, 2024
- Affected: fixed in 4.0.2.
- Fixed in 4.0.2 (released Jul 2, 2024, 14 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2024-34693](https://cve.now/CVE-2024-34693): Apache Superset: Server arbitrary file read

- Severity: Medium 6.8
- Published: Jun 20, 2024
- Affected: fixed in 3.1.3; from 4.0.0, fixed in 4.0.1; fixed in 3.1.3; from 4.0.0, fixed in 4.0.1.
- Fixed in 3.1.3 (released May 9, 2024, 42 days before disclosure) and 4.0.1 (released May 13, 2024, 38 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2024-28148](https://cve.now/CVE-2024-28148): Apache Superset: Incorrect datasource authorization on explore REST API

- Severity: Medium 4.3
- Published: May 7, 2024
- Affected: fixed in 3.1.2.
- Fixed in 3.1.2 (released Apr 3, 2024, 34 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2024-26016](https://cve.now/CVE-2024-26016): Apache Superset: Improper authorization validation on dashboards and charts import

- Severity: Medium 4.3
- Published: Feb 28, 2024
- Affected: fixed in 3.0.4; from 3.1.0, fixed in 3.1.1; fixed in 3.0.4; from 3.1.0, fixed in 3.1.1.
- Fixed in 3.0.4 (released Feb 20, 2024, 8 days before disclosure) and 3.1.1 (released Feb 20, 2024, 8 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2024-24779](https://cve.now/CVE-2024-24779): Apache Superset: Improper data authorization when creating a new dataset

- Severity: Medium 5.0
- Published: Feb 28, 2024
- Affected: fixed in 3.0.4; from 3.1.0, fixed in 3.1.1; fixed in 3.0.4; from 3.1.0, fixed in 3.1.1.
- Fixed in 3.0.4 (released Feb 20, 2024, 8 days before disclosure) and 3.1.1 (released Feb 20, 2024, 8 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2024-24772](https://cve.now/CVE-2024-24772): Apache Superset: Improper Neutralisation of custom SQL on embedded context

- Severity: Medium 4.3
- Published: Feb 28, 2024
- Affected: fixed in 3.0.4; from 3.1.0, fixed in 3.1.1; fixed in 3.0.4; from 3.1.0, fixed in 3.1.1.
- Fixed in 3.0.4 (released Feb 20, 2024, 8 days before disclosure) and 3.1.1 (released Feb 20, 2024, 8 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2024-24773](https://cve.now/CVE-2024-24773): Apache Superset: Improper validation of SQL statements allows for unauthorized access to data

- Severity: Medium 4.9
- Published: Feb 28, 2024
- Affected: fixed in 3.0.4; from 3.1.0, fixed in 3.1.1; fixed in 3.0.4; from 3.1.0, fixed in 3.1.1.
- Fixed in 3.0.4 (released Feb 20, 2024, 8 days before disclosure) and 3.1.1 (released Feb 20, 2024, 8 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2024-27315](https://cve.now/CVE-2024-27315): Apache Superset: Improper error handling on alerts

- Severity: Medium 4.3
- Published: Feb 28, 2024
- Affected: fixed in 3.0.4; from 3.1.0, fixed in 3.1.1; fixed in 3.0.4; from 3.1.0, fixed in 3.1.1.
- Fixed in 3.0.4 (released Feb 20, 2024, 8 days before disclosure) and 3.1.1 (released Feb 20, 2024, 8 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-49657](https://cve.now/CVE-2023-49657): Apache Superset: Stored XSS in Dashboard Title and Chart Title

- Severity: Critical 9.6
- Published: Jan 23, 2024
- Affected: fixed in 3.0.3.
- Fixed in 3.0.3 (released Jan 17, 2024, 6 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-49734](https://cve.now/CVE-2023-49734): Apache Superset: Privilege Escalation Vulnerability

- Severity: High 7.7
- Published: Dec 19, 2023
- Affected: fixed in 2.1.3; from 3.0.0, fixed in 3.0.2; fixed in 2.1.3; from 3.0.0, fixed in 3.0.2.
- Fixed in 2.1.3 (released Dec 16, 2023, 3 days before disclosure) and 3.0.2 (released Nov 22, 2023, 27 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-49736](https://cve.now/CVE-2023-49736): Apache Superset: SQL Injection on where\_in JINJA macro

- Severity: Medium 6.5
- Published: Dec 19, 2023
- Affected: fixed in 2.1.3; from 3.0.0, fixed in 3.0.2; fixed in 2.1.3; from 3.0.0, fixed in 3.0.2.
- Fixed in 2.1.3 (released Dec 16, 2023, 3 days before disclosure) and 3.0.2 (released Nov 22, 2023, 27 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-46104](https://cve.now/CVE-2023-46104): Apache Superset: Allows for uncontrolled resource consumption via a ZIP bomb

- Severity: Medium 6.5
- Published: Dec 19, 2023
- Affected: fixed in 2.1.2; from 3.0.0, fixed in 3.1.0rc1; fixed in 2.1.2; from 3.0.0, fixed in 3.1.0rc1.
- Fixed in 2.1.2 (released Nov 23, 2023, 26 days before disclosure) and 3.1.0rc1 (released Nov 28, 2023, 21 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-42504](https://cve.now/CVE-2023-42504): Apache Superset: Lack of rate limiting allows for possible denial of service

- Severity: Medium 5.8
- Published: Nov 28, 2023
- Affected: fixed in 3.0.0.
- Fixed in 3.0.0 (released Sep 18, 2023, 71 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-42505](https://cve.now/CVE-2023-42505): Apache Superset: Sensitive information disclosure on db connection details

- Severity: Medium 4.3
- Published: Nov 28, 2023
- Affected: fixed in 3.0.0.
- Fixed in 3.0.0 (released Sep 18, 2023, 71 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-42502](https://cve.now/CVE-2023-42502): Apache Superset: Open Redirect Vulnerability

- Severity: Medium 4.8
- Published: Nov 28, 2023
- Affected: fixed in 3.0.0.
- Fixed in 3.0.0 (released Sep 18, 2023, 71 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-43701](https://cve.now/CVE-2023-43701): Apache Superset: Stored XSS on API endpoint

- Severity: Medium 4.3
- Published: Nov 27, 2023
- Affected: fixed in 2.1.2.
- Fixed in 2.1.2 (released Nov 23, 2023, 4 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-42501](https://cve.now/CVE-2023-42501): Apache Superset: Unnecessary read permissions within the Gamma role

- Severity: Medium 4.3
- Published: Nov 27, 2023
- Affected: fixed in 2.1.2.
- Fixed in 2.1.2 (released Nov 23, 2023, 4 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-40610](https://cve.now/CVE-2023-40610): Apache Superset: Privilege escalation with default examples database

- Severity: Medium 6.3
- Published: Nov 27, 2023
- Affected: fixed in 2.1.2.
- Fixed in 2.1.2 (released Nov 23, 2023, 4 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-32672](https://cve.now/CVE-2023-32672): Apache Superset: SQL parser edge case bypasses data access authorization

- Severity: Medium 4.3
- Published: Sep 6, 2023
- Affected: through 2.1.0; fixed in 2.1.1.
- Fixed in 2.1.1 (released Aug 29, 2023, 8 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-37941](https://cve.now/CVE-2023-37941): Apache Superset: Metadata db write access can lead to remote code execution

- Severity: Medium 6.6
- Published: Sep 6, 2023
- Affected: from 1.5.0, fixed in 2.1.1.
- Fixed in 2.1.1 (released Aug 29, 2023, 8 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-39265](https://cve.now/CVE-2023-39265): Apache Superset: Possible Unauthorized Registration of SQLite Database Connections

- Severity: Low 3.8
- Published: Sep 6, 2023
- Affected: through 2.1.0; fixed in 2.1.1.
- Fixed in 2.1.1 (released Aug 29, 2023, 8 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-39264](https://cve.now/CVE-2023-39264): Apache Superset: Stack traces enabled by default

- Severity: Medium 4.3
- Published: Sep 6, 2023
- Affected: through 2.1.0; fixed in 2.1.1.
- Fixed in 2.1.1 (released Aug 29, 2023, 8 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-27523](https://cve.now/CVE-2023-27523): Apache Superset: Improper data permission validation on Jinja templated queries

- Severity: Medium 5.0
- Published: Sep 6, 2023
- Affected: fixed in 2.1.1; through 2.1.0.
- Fixed in 2.1.1 (released Aug 29, 2023, 8 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-36388](https://cve.now/CVE-2023-36388): Apache Superset: Improper API permission for low privilege users allows for SSRF

- Severity: Medium 4.3
- Published: Sep 6, 2023
- Affected: fixed in 2.1.1; through 2.1.0.
- Fixed in 2.1.1 (released Aug 29, 2023, 8 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-27526](https://cve.now/CVE-2023-27526): Apache Superset: Improper Authorization check on import charts

- Severity: Medium 4.3
- Published: Sep 6, 2023
- Affected: fixed in 2.1.1; through 2.1.0.
- Fixed in 2.1.1 (released Aug 29, 2023, 8 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-36387](https://cve.now/CVE-2023-36387): Apache Superset: Improper API permission for low privilege users

- Severity: Medium 5.4
- Published: Sep 6, 2023
- Affected: through 2.1.0.
- Fixed in 2.1.1 (released Aug 29, 2023, 8 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-30776](https://cve.now/CVE-2023-30776): Apache Superset: Database connection password leak

- Severity: Medium 4.9
- Published: Apr 24, 2023
- Affected: from 1.3.0, fixed in 2.1.0.
- Fixed in 2.1.0 (released Apr 5, 2023, 19 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-27524](https://cve.now/CVE-2023-27524): Apache Superset: Session validation vulnerability when using provided default SECRET\_KEY

- Severity: High 8.9 · KEV
- Published: Apr 24, 2023
- Affected: fixed in 2.1.0.
- Fixed in 2.1.0 (released Apr 5, 2023, 19 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-25504](https://cve.now/CVE-2023-25504): Apache Superset: Possible SSRF on import datasets

- Severity: Medium 4.9
- Published: Apr 17, 2023
- Affected: fixed in 2.1.0.
- Fixed in 2.1.0 (released Apr 5, 2023, 12 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2023-27525](https://cve.now/CVE-2023-27525): Apache Superset: Incorrect default permissions for Gamma role

- Severity: Low 3.1
- Published: Apr 17, 2023
- Affected: through 2.0.1; fixed in 2.1.0.
- Fixed in 2.1.0 (released Apr 5, 2023, 12 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2022-41703](https://cve.now/CVE-2022-41703): Apache Superset: SQL injection vulnerability in adhoc clauses

- Severity: Medium 5.4
- Published: Jan 16, 2023
- Affected: through 1.5.2; versions 2.0.0; fixed in 1.5.3; from 2.0.0, fixed in 2.0.1.
- Fixed in 1.5.3 (released Jan 13, 2023, 3 days before disclosure) and 2.0.1 (released Dec 20, 2022, 27 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2022-45438](https://cve.now/CVE-2022-45438): Apache Superset: Dashboard metadata information leak

- Severity: Medium 5.3
- Published: Jan 16, 2023
- Affected: fixed in 1.5.3; from 2.0.0, fixed in 2.0.1; through 1.5.2; versions 2.0.0.
- Fixed in 1.5.3 (released Jan 13, 2023, 3 days before disclosure) and 2.0.1 (released Dec 20, 2022, 27 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2022-43721](https://cve.now/CVE-2022-43721): Apache Superset: Open Redirect Vulnerability

- Severity: Medium 5.4
- Published: Jan 16, 2023
- Affected: fixed in 1.5.3; from 2.0.0, fixed in 2.0.1; through 1.5.2; versions 2.0.0.
- Fixed in 1.5.3 (released Jan 13, 2023, 3 days before disclosure) and 2.0.1 (released Dec 20, 2022, 27 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2022-43720](https://cve.now/CVE-2022-43720): Apache Superset: Improper rendering of user input

- Severity: Medium 5.4
- Published: Jan 16, 2023
- Affected: fixed in 1.5.3; from 2.0.0, fixed in 2.0.1; through 1.5.2; versions 2.0.0.
- Fixed in 1.5.3 (released Jan 13, 2023, 3 days before disclosure) and 2.0.1 (released Dec 20, 2022, 27 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2022-43719](https://cve.now/CVE-2022-43719): Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API

- Severity: High 8.8
- Published: Jan 16, 2023
- Affected: fixed in 1.5.3; from 2.0.0, fixed in 2.0.1; through 1.5.2; versions 2.0.0.
- Fixed in 1.5.3 (released Jan 13, 2023, 3 days before disclosure) and 2.0.1 (released Dec 20, 2022, 27 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2022-43718](https://cve.now/CVE-2022-43718): Apache Superset: Cross-Site Scripting vulnerability on upload forms

- Severity: Medium 5.4
- Published: Jan 16, 2023
- Affected: through 1.5.2; versions 2.0.0; fixed in 1.5.3; from 2.0.0, fixed in 2.0.1.
- Fixed in 1.5.3 (released Jan 13, 2023, 3 days before disclosure) and 2.0.1 (released Dec 20, 2022, 27 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2022-43717](https://cve.now/CVE-2022-43717): Apache Superset: Cross-Site Scripting on dashboards

- Severity: Medium 5.4
- Published: Jan 16, 2023
- Affected: fixed in 1.5.3; from 2.0.0, fixed in 2.0.1; through 1.5.2; versions 2.0.0.
- Fixed in 1.5.3 (released Jan 13, 2023, 3 days before disclosure) and 2.0.1 (released Dec 20, 2022, 27 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2021-37839](https://cve.now/CVE-2021-37839): Improper access to dataset metadata information

- Severity: Unrated
- Published: Jul 6, 2022
- Affected: fixed in 1.5.1.
- Fixed in 1.5.1 (released Jun 8, 2022, 28 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2022-27479](https://cve.now/CVE-2022-27479): SQL injection vulnerability in chart data API

- Severity: Unrated
- Published: Apr 13, 2022
- Affected: fixed in 1.4.2.
- Fixed in 1.4.2 (released Mar 29, 2022, 15 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2021-44451](https://cve.now/CVE-2021-44451): API sensitive information leak

- Severity: Unrated
- Published: Feb 1, 2022
- Affected: fixed in 1.4.0.
- Fixed in 1.4.0 (released Jan 19, 2022, 13 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2021-42250](https://cve.now/CVE-2021-42250): Possible log injection

- Severity: Unrated
- Published: Nov 17, 2021
- Affected: fixed in 1.3.2.
- Fixed in 1.3.2 (released Oct 20, 2021, 28 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2021-41972](https://cve.now/CVE-2021-41972): Credentials leak

- Severity: Unrated
- Published: Nov 12, 2021
- Affected: fixed in 1.3.2.
- Fixed in 1.3.2 (released Oct 20, 2021, 23 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2021-41971](https://cve.now/CVE-2021-41971): Possible SQL Injection when template processing is enabled

- Severity: Unrated
- Published: Oct 18, 2021
- Affected: fixed in 1.3.1.
- Fixed in 1.3.1 (released Sep 28, 2021, 20 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2021-32609](https://cve.now/CVE-2021-32609): XSS vulnerability on Explore page

- Severity: Unrated
- Published: Oct 18, 2021
- Affected: fixed in 1.2.0.
- Fixed in 1.2.0 (released Jul 2, 2021, 108 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2021-28125](https://cve.now/CVE-2021-28125): Apache Superset Open Redirect

- Severity: Unrated
- Published: Apr 27, 2021
- Affected: fixed in 1.1.0.
- Fixed in 1.1.0 (released Apr 13, 2021, 14 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2021-27907](https://cve.now/CVE-2021-27907): Apache Superset stored XSS on Dashboard markdown

- Severity: Unrated
- Published: Mar 5, 2021
- Affected: fixed in 0.38.1.
- Fixed in 0.38.1 (released Mar 1, 2021, 4 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2020-13952](https://cve.now/CVE-2020-13952): In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto…

- Severity: Unrated
- Published: Sep 30, 2020
- Affected: fixed in 0.37.2.
- Fixed in 0.37.2 (released Sep 27, 2020, 3 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2020-13948](https://cve.now/CVE-2020-13948): While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests via a number of…

- Severity: Unrated
- Published: Sep 17, 2020
- Affected: fixed in 0.37.1.
- Fixed in 0.37.1 (released Sep 15, 2020, 2 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2020-1932](https://cve.now/CVE-2020-1932): An information disclosure issue was found in Apache Superset 0.34.0, 0.34.1, 0.35.0, and 0.35.1.

- Severity: Unrated
- Published: Jan 28, 2020
- Affected: fixed in 0.35.2; from 0.34.0, fixed in 0.35.2.
- Fixed in 0.35.2 (released Jan 15, 2020, 13 days before disclosure).
- The latest release, 6.1.0, is not affected.

### [CVE-2019-12413](https://cve.now/CVE-2019-12413): In Apache Incubator Superset before 0.31 user could query database metadata information from a database he has no access to, by using a…

- Severity: Unrated
- Published: Dec 16, 2019
- Affected: fixed in 0.31; fixed in 0.31.0.
- Fixed in 0.34.0 (released Sep 18, 2019, 89 days before disclosure, the advisory names 0.31, which was never published).
- The latest release, 6.1.0, is not affected.

### [CVE-2019-12414](https://cve.now/CVE-2019-12414): In Apache Incubator Superset before 0.32, a user can view database names that he has no access to on a dropdown list in SQLLab

- Severity: Unrated
- Published: Dec 16, 2019
- Affected: fixed in 0.32; fixed in 0.32.0.
- Fixed in 0.34.0 (released Sep 18, 2019, 89 days before disclosure, the advisory names 0.32, which was never published).
- The latest release, 6.1.0, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/pypi/apache-superset
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.