PT-2026-21679 · Apache · Apache Superset

Dhanush Nayak + 2 · Publicado 2026-02-24 · Atualizado 2026-02-28 · CVE-2026-23980

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 6.0.0

Description An issue exists in Apache Superset that allows an authenticated user with read access to conduct error-based SQL injection. This is due to improper neutralization of special elements used in a SQL command. The issue can be triggered via the sqlExpression or where parameters.

Recommendations Upgrade to version 6.0.0 to resolve the issue.

Correção

SQL injection

Enumeração de Fraquezas

CWE-89

Identificadores relacionados

BIT-SUPERSET-2026-23980

CVE-2026-23980

GHSA-GVXG-9HQX-F4RG

Produtos afetados

Apache Superset

Referências · 10

• https://github.com/apache/superset · Nota
• https://osv.dev/vulnerability/CVE-2026-23980 · Aviso do Fabricante
• https://lists.apache.org/thread/h4l02zw1pr2vywv0dc5zjn3grdcdhwf4 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-gvxg-9hqx-f4rg · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-23980 · Nota de Segurança
• https://twitter.com/infoflowcloud/status/2027842725010178140 · Publicação no Twitter
• https://twitter.com/CVEnew/status/2027841533421252682 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-superset-2026-23980 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2026/02/24/5 · Nota
• https://twitter.com/oss_security/status/2026525905405829227 · Publicação no Twitter