PT-2026-21681 · Apache · Apache Superset

Daniel Gaspar + 1 · CVE-2026-23983 · Published 2026-02-24 · Updated 2026-07-13

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 6.0.0

Description A sensitive data exposure issue exists in Apache Superset that allows authenticated users to retrieve sensitive user information. The '/api/v1/tag' API endpoint, when enabled, improperly serializes and returns sensitive fields associated with user objects, including password hashes (pbkdf2), email addresses, and login statistics. Users with low privileges, such as those with the Gamma role, can view this sensitive authentication data.

Recommendations Upgrade to version 6.0.0, which resolves the issue. Ensure TAGGING SYSTEM is set to False, as this is the default configuration for Apache Superset.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-SUPERSET-2026-23983

CVE-2026-23983

ECHO-91E6-90E7-361A

GHSA-H294-8FXM-M2PJ

PYSEC-2026-2375

Affected Products

Apache Superset

References · 14

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23983.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-23983 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h294-8fxm-m2pj · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23983 · Security Note
• https://osv.dev/vulnerability/BIT-superset-2026-23983 · Vendor Advisory
• https://lists.apache.org/thread/62mgbc5hc8026skp69kb6vqozj3pr5ww · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2026-2375 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://twitter.com/CVEnew/status/2027841535275110662 · Twitter Post
• https://twitter.com/oss_security/status/2026525907813306789 · Twitter Post
• https://pypi.org/project/apache-superset · Note
• http://openwall.com/lists/oss-security/2026/02/24/7 · Note
• https://github.com/advisories/GHSA-h294-8fxm-m2pj · Note
• https://twitter.com/infoflowcloud/status/2027842698116215140 · Twitter Post