---
id: CVE-2022-41703
aliases:
  - GHSA-cxvp-3frm-3876
  - BIT-superset-2022-41703
  - PYSEC-2026-780
title: Apache Superset's SQL Alchemy connector vulnerable to SQL Injection
summary: Apache Superset's SQL Alchemy connector vulnerable to SQL Injection
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N'
vendor: apache-superset
product: apache-superset
ecosystem: pip
affected:
  - apache-superset <= 1.5.2
  - apache-superset
published: '2023-01-16'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-cxvp-3frm-3876'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2022-41703'
  - url: 'https://github.com/apache/superset'
  - url: 'https://lists.apache.org/thread/g7jjw0okxjk5y57pbbxy19ydw42kqcos'
tags:
  - osv
  - pip
epss: 0.01203
epssPercentile: 0.66928
ingestedAt: '2026-07-08T18:25:48.614Z'
---

## Overview

A vulnerability in the SQL Alchemy connector of Apache Superset allows an authenticated user with read access to a specific database to add subqueries to the WHERE and HAVING fields referencing tables on the same database that the user should not have access to, despite the user having the feature flag "ALLOW_ADHOC_SUBQUERY" disabled (default value). This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

## Affected packages

- `apache-superset <= 1.5.2`
- `apache-superset`

## Remediation

Refer to the advisory for the patched release.