# apache-superset (PyPI) vulnerabilities Source: https://junglewise.ai/threats/technologies/apache-superset Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/apache-superset.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 68 vulnerabilities in apache-superset (PyPI): 0 in the last 7 days and 0 in the last 90 days, 2 of them critical and 1 exploited in the wild. The most recent, CVE-2026-23984, was published on 13 July 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 68 (2 critical, 1 exploited in the wild) ## About apache-superset (PyPI) Business intelligence and data visualization platform for exploring and visualizing data. ## Latest apache-superset (PyPI) vulnerabilities - [CVE-2026-23984: PYSEC-2026-2376 - Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections](https://junglewise.ai/threats/cve-2026-23984-apache-superset-read-only-bypass-via-improper-input-validation-on) (medium, CVSS 4, published 13 Jul 2026) - [CVE-2026-23983: PYSEC-2026-2375 - Apache Superset allows authenticated users to view sensitive data without explicit permissions](https://junglewise.ai/threats/cve-2026-23983-apache-superset-allows-authenticated-users-to-view-sensitive-data) (medium, CVSS 4, published 13 Jul 2026) - [CVE-2026-23969: PYSEC-2026-2373 - Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine](https://junglewise.ai/threats/cve-2026-23969-apache-superset-incomplete-disallowed-sql-functions-default-list) (medium, CVSS 4, published 13 Jul 2026) - [CVE-2026-23980: PYSEC-2026-2374 - Apache Superset allows privileged users to conduct error-based SQL Injection](https://junglewise.ai/threats/cve-2026-23980-apache-superset-allows-privileged-users-to-conduct-error-based) (medium, CVSS 4, published 13 Jul 2026) - [CVE-2026-23982: PYSEC-2026-2372 - Apache Superset Improper Authorization allows low-privileged users to bypass access controls](https://junglewise.ai/threats/cve-2026-23982-apache-superset-improper-authorization-in-dataset-access-controls) (medium, CVSS 4, published 13 Jul 2026) - [CVE-2021-28125: PYSEC-2026-3078 - Open Redirect in Apache Superset](https://junglewise.ai/threats/cve-2021-28125-open-redirect-in-apache-superset) (low, CVSS 3.1, published 9 Jul 2026) - [CVE-2025-55674: PYSEC-2026-1178 - Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions](https://junglewise.ai/threats/cve-2025-55674-apache-superset-has-bypass-of-disallowed-sql-functions-that) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2025-55673: PYSEC-2026-1169 - Apache Superset data query improperly discloses database schema information to low-privileged guest user](https://junglewise.ai/threats/cve-2025-55673-apache-superset-data-query-improperly-discloses-database-schema) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2025-55672: PYSEC-2026-1176 - Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability](https://junglewise.ai/threats/cve-2025-55672-apache-superset-s-chart-visualization-has-a-stored-cross-site) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2025-55675: Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access](https://junglewise.ai/threats/cve-2025-55675-apache-superset-allows-authenticated-users-to-discover-metadata) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2025-48912: PYSEC-2026-1164 - Apache Superset: Improper authorization bypass on row level security via SQL Injection](https://junglewise.ai/threats/cve-2025-48912-apache-superset-improper-authorization-bypass-on-row-level) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2025-27696: PYSEC-2026-1189 - Apache Superset Allows Ownership Takeover](https://junglewise.ai/threats/cve-2025-27696-apache-superset-allows-ownership-takeover) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-55633: PYSEC-2026-1162 - Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access](https://junglewise.ai/threats/cve-2024-55633-apache-superset-sqllab-improper-readonly-query-validation-allows) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-53948: PYSEC-2026-1154 - Apache Superset: Error verbosity exposes metadata in analytics databases](https://junglewise.ai/threats/cve-2024-53948-apache-superset-error-verbosity-information-disclosure) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-53947: PYSEC-2026-1165 - Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions](https://junglewise.ai/threats/cve-2024-53947-apache-superset-improper-sql-authorisation-parse-not-checking-for) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-53949: PYSEC-2026-1156 - Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled](https://junglewise.ai/threats/cve-2024-53949-apache-superset-authorization-bypass-in-role-creation-api) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-39887: PYSEC-2026-1155 - Apache Superset vulnerable to improper SQL authorization](https://junglewise.ai/threats/cve-2024-39887-apache-superset-improper-sql-authorization-with-engine-functions) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-34693: PYSEC-2026-1183 - Apache Superset server arbitrary file read](https://junglewise.ai/threats/cve-2024-34693-apache-superset-server-arbitrary-file-read) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-28148: PYSEC-2026-1153 - Apache Superset Incorrect Authorization vulnerability](https://junglewise.ai/threats/cve-2024-28148-apache-superset-incorrect-authorization-in-datasource-rest-api) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-26016: PYSEC-2026-1158 - Apache Superset: Improper authorization validation on dashboards and charts import](https://junglewise.ai/threats/cve-2024-26016-apache-superset-improper-authorization-validation-on-dashboards) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-24779: PYSEC-2026-1191 - Apache Superset: Improper data authorization when creating a new dataset](https://junglewise.ai/threats/cve-2024-24779-apache-superset-improper-data-authorization-when-creating-a-new) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-24773: PYSEC-2026-1160 - Apache Superset: Improper validation of SQL statements allows for unauthorized access to data](https://junglewise.ai/threats/cve-2024-24773-apache-superset-improper-validation-of-sql-statements-allows-for) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-24772: PYSEC-2026-1185 - Apache Superset: Improper Neutralization of custom SQL on embedded context](https://junglewise.ai/threats/cve-2024-24772-apache-superset-improper-neutralization-of-custom-sql-on-embedded) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-27315: PYSEC-2026-1181 - Apache Superset: Improper error handling on alerts](https://junglewise.ai/threats/cve-2024-27315-apache-superset-improper-error-handling-on-alerts) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2023-49734: PYSEC-2026-1180 - Apache Superset incorrect write permissions vulnerability](https://junglewise.ai/threats/cve-2023-49734-apache-superset-incorrect-write-permissions-vulnerability) (low, CVSS 3.1, published 7 Jul 2026) ## Most severe apache-superset (PyPI) vulnerabilities - [CVE-2023-27524: PYSEC-2026-1161 - Apache superset missing check for default SECRET_KEY](https://junglewise.ai/threats/cve-2023-27524-apache-superset-insecure-default-initialization-of-resource) (critical, exploited in the wild, CVSS 3.1, published 7 Jul 2026) - [CVE-2023-49657: Cross-site Scripting in Apache superset](https://junglewise.ai/threats/cve-2023-49657-cross-site-scripting-in-apache-superset) (critical, CVSS 9.6, published 23 Jan 2024) - [CVE-2025-55672: PYSEC-2026-1176 - Apache Superset's chart visualization has a stored Cross-Site Scripting (XSS) vulnerability](https://junglewise.ai/threats/cve-2025-55672-apache-superset-s-chart-visualization-has-a-stored-cross-site) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2025-48912: PYSEC-2026-1164 - Apache Superset: Improper authorization bypass on row level security via SQL Injection](https://junglewise.ai/threats/cve-2025-48912-apache-superset-improper-authorization-bypass-on-row-level) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2025-55674: PYSEC-2026-1178 - Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions](https://junglewise.ai/threats/cve-2025-55674-apache-superset-has-bypass-of-disallowed-sql-functions-that) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2026-23980: PYSEC-2026-2374 - Apache Superset allows privileged users to conduct error-based SQL Injection](https://junglewise.ai/threats/cve-2026-23980-apache-superset-allows-privileged-users-to-conduct-error-based) (medium, CVSS 4, published 13 Jul 2026) - [CVE-2026-23969: PYSEC-2026-2373 - Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine](https://junglewise.ai/threats/cve-2026-23969-apache-superset-incomplete-disallowed-sql-functions-default-list) (medium, CVSS 4, published 13 Jul 2026) - [CVE-2025-55673: PYSEC-2026-1169 - Apache Superset data query improperly discloses database schema information to low-privileged guest user](https://junglewise.ai/threats/cve-2025-55673-apache-superset-data-query-improperly-discloses-database-schema) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2025-55675: Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access](https://junglewise.ai/threats/cve-2025-55675-apache-superset-allows-authenticated-users-to-discover-metadata) (medium, CVSS 4, published 7 Jul 2026) - [CVE-2026-23982: PYSEC-2026-2372 - Apache Superset Improper Authorization allows low-privileged users to bypass access controls](https://junglewise.ai/threats/cve-2026-23982-apache-superset-improper-authorization-in-dataset-access-controls) (medium, CVSS 4, published 13 Jul 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other PyPI technologies - [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities - [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities - [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities - [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities - [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities - [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities - [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities - [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities - [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities - [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities - [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities - [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "apache-superset (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/apache-superset, 13 November 2026.