---
id: CVE-2021-28125
aliases:
  - GHSA-pfwg-rxf4-97c3
  - BIT-superset-2021-28125
  - PYSEC-2021-128
  - PYSEC-2026-3078
title: Open Redirect in Apache Superset
summary: Open Redirect in Apache Superset
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
vendor: superset
product: superset
ecosystem: pip
affected:
  - superset <= 0.34.0
  - apache-superset < 1.1.0
patched:
  - apache-superset 1.1.0
published: '2021-10-06'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-pfwg-rxf4-97c3'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-28125'
  - url: >-
      https://github.com/apache/superset/commit/eb35b804acf4d84cb70d02743e04b8afebbee029
  - url: 'https://github.com/advisories/GHSA-pfwg-rxf4-97c3'
  - url: 'https://github.com/apache/superset'
  - url: >-
      https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2021-128.yaml
  - url: >-
      https://lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434%40%3Cdev.superset.apache.org%3E
  - url: >-
      https://lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434@%3Cdev.superset.apache.org%3E
  - url: 'http://www.openwall.com/lists/oss-security/2021/04/27/2'
tags:
  - osv
  - pip
epss: 0.64016
epssPercentile: 0.99198
ingestedAt: '2026-07-13T18:58:01.414Z'
---

## Overview

Apache Superset prior to 1.1.0 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.

## Affected packages

- `superset <= 0.34.0`
- `apache-superset < 1.1.0`

## Remediation

Upgrade to a patched release:

- `apache-superset 1.1.0`