CVE-2024-39887Medium· 4.3▾ TwilightPoC availableApache Superset vulnerable to improper SQL authorization
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 23.7 · likelihood 0.9 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Public exploit / PoC code seen in 1 source. Availability, not in-the-wild use.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
4.4%
Nuclei ×1
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL commands. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. To mitigate this, a new configuration key named DISALLOWED_SQL_FUNCTIONS has been introduced. This key disallows the use of the following PostgreSQL functions: version, query_to_xml, inet_server_addr, and inet_client_addr. Additional functions can be added to this list for increased protection.
This issue affects Apache Superset: before 4.0.2.
Users are recommended to upgrade to version 4.0.2, which fixes the issue.
apache-superset < 4.0.2Upgrade to a patched release:
apache-superset 4.0.2Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-23980MediumApache Superset allows privileged users to conduct error-based SQL Injection
CVE-2024-34693Medium· 6.8Apache Superset server arbitrary file read
CVE-2023-39265Medium· 6.5Apache Superset Improper Input Validation vulnerability
CVE-2023-37941Medium· 6.6Apache Superset Deserialization of Untrusted Data vulnerability
CVE-2023-27524High· 8.9Apache superset missing check for default SECRET_KEY
CVE-2026-23984HighApache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections