Executive brief
Apache Superset allows privileged users to conduct error-based SQL Injection
Affected products
- PyPI apache-superset
Junglewise Threat Intelligence
CVE-2026-23980: Apache Superset allows privileged users to conduct error-based SQL Injection
CVE-2026-23980 · Severity: medium · CVSS 4 · Published 2026-02-24
Technologies: apache-superset (PyPI). Vendors: PyPI.
Related threats
- Apache Superset improper authorization in dataset access controls
- Apache Superset allows authenticated users to view sensitive data without explicit permissions
- Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
- Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
- Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions