---
id: CVE-2023-42502
aliases:
  - GHSA-hc74-9vjm-c9xv
  - BIT-superset-2023-42502
  - PYSEC-2026-1182
title: Apache Superset Open Redirect vulnerability
summary: Apache Superset Open Redirect vulnerability
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'
vendor: apache-superset
product: apache-superset
ecosystem: pip
affected:
  - apache-superset < 3.0.0
patched:
  - apache-superset 3.0.0
published: '2023-11-28'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-hc74-9vjm-c9xv'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-42502'
  - url: 'https://github.com/apache/superset'
  - url: 'https://lists.apache.org/thread/n8348f194d8o8mln3oxd0s8jdl5bxbmn'
  - url: 'http://www.openwall.com/lists/oss-security/2023/11/28/3'
tags:
  - osv
  - pip
epss: 0.0083
epssPercentile: 0.55744
ingestedAt: '2026-07-08T18:25:50.045Z'
---

## Overview

An authenticated attacker with update datasets permission could change a dataset link to an untrusted site by spoofing the HTTP Host header, users could be redirected to this site when clicking on that specific dataset. This issue affects Apache Superset versions before 3.0.0.


## Affected packages

- `apache-superset < 3.0.0`

## Remediation

Upgrade to a patched release:

- `apache-superset 3.0.0`