PT-2026-21682 · Postgresql Global Development Group+1 · Postgresql+1

Trung Đức Lê · Publicado 2026-02-24 · Atualizado 2026-03-02 · CVE-2026-23984

Positive Technologies (AI Summary)

CVSS v4.0

7.1

Alta

Vetor base

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 6.0.0

Description An issue exists in Apache Superset where an authenticated user with SQLLab access can bypass the read-only verification check when using a PostgreSQL database connection. The system does not detect specially crafted SQL statements that contain Data Manipulation Language (DML) commands, such as INSERT, UPDATE, and DELETE, on connections configured as read-only. The vulnerable component is the read-only verification process within SQLLab.

Recommendations Upgrade to version 6.0.0 to resolve the issue.

Correção

Incorrect Authorization

Information Disclosure

Enumeração de Fraquezas

CWE-863

CWE-200

Identificadores relacionados

BIT-SUPERSET-2026-23984

CVE-2026-23984

GHSA-MWF2-QR4V-94H2

Produtos afetados

Apache Superset

Postgresql

Referências · 11

• https://github.com/apache/superset · Nota
• https://lists.apache.org/thread/72cmgxtvp9pclto4ln1chbs1227nwd26 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2026/02/24/8 · Nota
• https://twitter.com/CVEnew/status/2027841536067833876 · Publicação no Twitter
• https://osv.dev/vulnerability/GHSA-mwf2-qr4v-94h2 · Aviso do Fabricante
• https://twitter.com/oss_security/status/2026525907813306789 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2027842779842249119 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2026-23984 · Aviso do Fabricante
• https://twitter.com/pulsepatchio/status/2028482271108337969 · Publicação no Twitter
• https://osv.dev/vulnerability/BIT-superset-2026-23984 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2026-23984 · Nota de Segurança