CVE-2024-34693Medium· 6.8▾ TwilightPoC availableApache Superset server arbitrary file read
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 37.4 · likelihood 0.3 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.6%
1.6% → 1.6%
2 GitHub repos
Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table. This issue affects Apache Superset before version 3.1.3 and in version 4.0.0.
Users are recommended to upgrade to version 4.0.1 or 3.1.3, both of which fix the issue.
apache-superset < 3.1.3apache-superset >= 4.0.0, < 4.0.1Upgrade to a patched release:
apache-superset 3.1.3apache-superset 4.0.1Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-23980MediumApache Superset allows privileged users to conduct error-based SQL Injection
CVE-2023-39265Medium· 6.5Apache Superset Improper Input Validation vulnerability
CVE-2023-37941Medium· 6.6Apache Superset Deserialization of Untrusted Data vulnerability
CVE-2023-27524High· 8.9Apache superset missing check for default SECRET_KEY
CVE-2024-39887Medium· 4.3Apache Superset vulnerable to improper SQL authorization
CVE-2026-23984HighApache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections