Executive brief
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Affected products
- PyPI apache-superset
Junglewise Threat Intelligence
CVE-2025-55674: PYSEC-2026-1178 - Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
CVE-2025-55674 · Severity: medium · CVSS 4 · Published 2026-07-07
Technologies: apache-superset (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-2376 - Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
- PYSEC-2026-2375 - Apache Superset allows authenticated users to view sensitive data without explicit permissions
- PYSEC-2026-2373 - Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
- PYSEC-2026-2374 - Apache Superset allows privileged users to conduct error-based SQL Injection
- PYSEC-2026-2372 - Apache Superset Improper Authorization allows low-privileged users to bypass access controls