PT-2026-21679 · Apache · Apache Superset

Dhanush Nayak + 2 · CVE-2026-23980 · Published 2026-02-24 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 6.0.0

Description An issue exists in Apache Superset that allows an authenticated user with read access to conduct error-based SQL injection. This is due to improper neutralization of special elements used in a SQL command. The issue can be triggered via the sqlExpression or where parameters.

Recommendations Upgrade to version 6.0.0 to resolve the issue.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BIT-SUPERSET-2026-23980

CVE-2026-23980

ECHO-5674-14E4-2B1F

GHSA-GVXG-9HQX-F4RG

PYSEC-2026-2374

Affected Products

Apache Superset

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23980.json · Exploit
• https://osv.dev/vulnerability/BIT-superset-2026-23980 · Vendor Advisory
• https://lists.apache.org/thread/h4l02zw1pr2vywv0dc5zjn3grdcdhwf4 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2374 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23980 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23980 · Security Note
• https://osv.dev/vulnerability/GHSA-gvxg-9hqx-f4rg · Vendor Advisory
• https://github.com/apache/superset · Note
• https://pypi.python.org · Note
• https://pypi.org/project/apache-superset · Note
• http://openwall.com/lists/oss-security/2026/02/24/5 · Note
• https://twitter.com/oss_security/status/2026525905405829227 · Twitter Post
• https://twitter.com/infoflowcloud/status/2027842725010178140 · Twitter Post
• https://twitter.com/CVEnew/status/2027841533421252682 · Twitter Post
• https://github.com/advisories/GHSA-gvxg-9hqx-f4rg · Note