PT-2026-21682 · Postgresql Global Development Group+1 · Postgresql+1

Trung Đức Lê · Published 2026-02-24 · Updated 2026-03-02 · CVE-2026-23984

Positive Technologies (AI Summary)

CVSS v4.0

7.1

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 6.0.0

Description An issue exists in Apache Superset where an authenticated user with SQLLab access can bypass the read-only verification check when using a PostgreSQL database connection. The system does not detect specially crafted SQL statements that contain Data Manipulation Language (DML) commands, such as INSERT, UPDATE, and DELETE, on connections configured as read-only. The vulnerable component is the read-only verification process within SQLLab.

Recommendations Upgrade to version 6.0.0 to resolve the issue.

Fix

Incorrect Authorization

Information Disclosure

Weakness Enumeration

CWE-863

CWE-200

Related Identifiers

BIT-SUPERSET-2026-23984

CVE-2026-23984

GHSA-MWF2-QR4V-94H2

Affected Products

Apache Superset

Postgresql

References · 11

• https://lists.apache.org/thread/72cmgxtvp9pclto4ln1chbs1227nwd26 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-mwf2-qr4v-94h2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-23984 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-superset-2026-23984 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-23984 · Security Note
• https://github.com/apache/superset · Note
• http://openwall.com/lists/oss-security/2026/02/24/8 · Note
• https://twitter.com/CVEnew/status/2027841536067833876 · Twitter Post
• https://twitter.com/oss_security/status/2026525907813306789 · Twitter Post
• https://twitter.com/infoflowcloud/status/2027842779842249119 · Twitter Post
• https://twitter.com/pulsepatchio/status/2028482271108337969 · Twitter Post