PT-2026-21681 · Apache · Apache Superset

Daniel Gaspar + 1 · Published 2026-02-24 · Updated 2026-02-28 · CVE-2026-23983

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 6.0.0

Description A sensitive data exposure issue exists in Apache Superset that allows authenticated users to retrieve sensitive user information. The '/api/v1/tag' API endpoint, when enabled, improperly serializes and returns sensitive fields associated with user objects, including password hashes (pbkdf2), email addresses, and login statistics. Users with low privileges, such as those with the Gamma role, can view this sensitive authentication data.

Recommendations Upgrade to version 6.0.0, which resolves the issue. Ensure TAGGING SYSTEM is set to False, as this is the default configuration for Apache Superset.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BIT-SUPERSET-2026-23983

CVE-2026-23983

GHSA-H294-8FXM-M2PJ

Affected Products

Apache Superset

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-23983 · Security Note
• https://lists.apache.org/thread/62mgbc5hc8026skp69kb6vqozj3pr5ww · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h294-8fxm-m2pj · Vendor Advisory
• https://osv.dev/vulnerability/BIT-superset-2026-23983 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23983 · Vendor Advisory
• https://github.com/apache/superset · Note
• https://twitter.com/CVEnew/status/2027841535275110662 · Twitter Post
• https://twitter.com/oss_security/status/2026525907813306789 · Twitter Post
• http://openwall.com/lists/oss-security/2026/02/24/7 · Note
• https://twitter.com/infoflowcloud/status/2027842698116215140 · Twitter Post