---
id: CVE-2026-23980
aliases:
  - GHSA-gvxg-9hqx-f4rg
  - BIT-superset-2026-23980
  - PYSEC-2026-2374
title: Apache Superset allows privileged users to conduct error-based SQL Injection
summary: Apache Superset allows privileged users to conduct error-based SQL Injection
severity: medium
vendor: apache-superset
product: apache-superset
ecosystem: pip
affected:
  - apache-superset < 6.0.0
patched:
  - apache-superset 6.0.0
published: '2026-02-24'
updated: '2026-07-13'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-gvxg-9hqx-f4rg'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-23980'
  - url: 'https://github.com/apache/superset'
  - url: 'https://lists.apache.org/thread/h4l02zw1pr2vywv0dc5zjn3grdcdhwf4'
  - url: 'http://www.openwall.com/lists/oss-security/2026/02/24/5'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.00615
epssPercentile: 0.48081
ingestedAt: '2026-07-13T18:57:58.616Z'
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/oscar-mine/CVE-2026-23980-Exploit'
    - 'https://github.com/hyphenTBG/CVE-2026-23980'
  checkedAt: '2026-09-23T07:13:55.603Z'
exploitAvailable: true
---

## Overview

Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters.

This issue affects Apache Superset: before 6.0.0.

Users are recommended to upgrade to version 6.0.0, which fixes the issue.

## Affected packages

- `apache-superset < 6.0.0`

## Remediation

Upgrade to a patched release:

- `apache-superset 6.0.0`