PT-2022-10673 · Apache · Apache Superset

Dinesh · CVE-2021-37839 · Published 2022-07-06 · Updated 2026-07-06

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions up to 1.5.1

Description The issue allows authenticated users to access metadata information related to datasets they have no permission on. This metadata includes the dataset name, columns, and metrics.

Recommendations For Apache Superset versions up to 1.5.1, update to a version later than 1.5.1 to resolve the issue. As a temporary workaround, consider restricting access to metadata information for authenticated users until a patch is available.

Fix

Weakness Enumeration

CWE-273

Related Identifiers

BIT-SUPERSET-2021-37839

CVE-2021-37839

GHSA-748R-5R8Q-273M

PYSEC-2026-776

Affected Products

Apache Superset

References · 12

• https://osv.dev/vulnerability/GHSA-748r-5r8q-273m · Vendor Advisory
• https://osv.dev/vulnerability/BIT-superset-2021-37839 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-37839 · Security Note
• https://osv.dev/vulnerability/CVE-2021-37839 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-776 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://github.com/apache/superset/commit/2bd89d1705347da5446902a3f65eb8d0a6353503 · Note
• https://lists.apache.org/thread/pwqyxxmn5gh7cnw3qsp66v0lt4xojt82 · Note
• https://github.com/advisories/GHSA-748r-5r8q-273m · Note
• https://t.me/cibsecurity/45646 · Telegram Post
• https://pypi.org/project/apache-superset · Note
• https://t.me/cvenotify/33035 · Telegram Post