PT-2026-21681 · Apache · Apache Superset

Daniel Gaspar + 1 · Publicado 2026-02-24 · Atualizado 2026-02-28 · CVE-2026-23983

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 6.0.0

Description A sensitive data exposure issue exists in Apache Superset that allows authenticated users to retrieve sensitive user information. The '/api/v1/tag' API endpoint, when enabled, improperly serializes and returns sensitive fields associated with user objects, including password hashes (pbkdf2), email addresses, and login statistics. Users with low privileges, such as those with the Gamma role, can view this sensitive authentication data.

Recommendations Upgrade to version 6.0.0, which resolves the issue. Ensure TAGGING SYSTEM is set to False, as this is the default configuration for Apache Superset.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BIT-SUPERSET-2026-23983

CVE-2026-23983

GHSA-H294-8FXM-M2PJ

Produtos afetados

Apache Superset

Referências · 10

• https://github.com/apache/superset · Nota
• https://twitter.com/CVEnew/status/2027841535275110662 · Publicação no Twitter
• https://twitter.com/oss_security/status/2026525907813306789 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-23983 · Nota de Segurança
• https://lists.apache.org/thread/62mgbc5hc8026skp69kb6vqozj3pr5ww · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-h294-8fxm-m2pj · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2026/02/24/7 · Nota
• https://twitter.com/infoflowcloud/status/2027842698116215140 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-superset-2026-23983 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2026-23983 · Aviso do Fabricante