PT-2026-21678 · Apache · Apache Superset

Daniel Gaspar + 1 · Published 2026-02-24 · Updated 2026-03-02 · CVE-2026-23969

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 4.1.2

Description Apache Superset uses a configurable dictionary, DISALLOWED SQL FUNCTIONS, to limit the execution of potentially sensitive SQL functions in SQL Lab and charts. A flaw exists because the default list for the ClickHouse engine was not comprehensive, allowing potentially harmful SQL functions to be executed.

Recommendations Upgrade to version 4.1.2 to resolve the issue.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-SUPERSET-2026-23969

CVE-2026-23969

GHSA-48M2-V2R8-H23M

Affected Products

Apache Superset

References · 11

• https://osv.dev/vulnerability/GHSA-48m2-v2r8-h23m · Vendor Advisory
• https://osv.dev/vulnerability/BIT-superset-2026-23969 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23969 · Security Note
• https://lists.apache.org/thread/2q22sp4oj3krcgdkxchhtht0vgwp2wnd · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23969 · Vendor Advisory
• https://github.com/apache/superset · Note
• http://openwall.com/lists/oss-security/2026/02/24/4 · Note
• https://t.me/cveNotify/153334 · Telegram Post
• https://twitter.com/CVEnew/status/2027841532565590119 · Twitter Post
• https://twitter.com/infoflowcloud/status/2027842664310173900 · Twitter Post
• https://twitter.com/oss_security/status/2026525905405829227 · Twitter Post