PT-2026-21678 · Apache · Apache Superset

Daniel Gaspar + 1 · Publicado 2026-02-24 · Atualizado 2026-03-02 · CVE-2026-23969

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 4.1.2

Description Apache Superset uses a configurable dictionary, DISALLOWED SQL FUNCTIONS, to limit the execution of potentially sensitive SQL functions in SQL Lab and charts. A flaw exists because the default list for the ClickHouse engine was not comprehensive, allowing potentially harmful SQL functions to be executed.

Recommendations Upgrade to version 4.1.2 to resolve the issue.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BIT-SUPERSET-2026-23969

CVE-2026-23969

GHSA-48M2-V2R8-H23M

Produtos afetados

Apache Superset

Referências · 11

• https://github.com/apache/superset · Nota
• http://openwall.com/lists/oss-security/2026/02/24/4 · Nota
• https://osv.dev/vulnerability/GHSA-48m2-v2r8-h23m · Aviso do Fabricante
• https://osv.dev/vulnerability/BIT-superset-2026-23969 · Aviso do Fabricante
• https://t.me/cveNotify/153334 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2026-23969 · Nota de Segurança
• https://lists.apache.org/thread/2q22sp4oj3krcgdkxchhtht0vgwp2wnd · Aviso do Fabricante
• https://twitter.com/CVEnew/status/2027841532565590119 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-23969 · Aviso do Fabricante
• https://twitter.com/infoflowcloud/status/2027842664310173900 · Publicação no Twitter
• https://twitter.com/oss_security/status/2026525905405829227 · Publicação no Twitter