CVE-2023-42502: Apache Superset Open Redirect vulnerability
Summary
CVE-2023-42502: Apache Superset Open Redirect vulnerability. Affects apache-superset versions < 3.0.0. Fixed in 3.0.0. How to fix ↓
Also tracked for
- superset · Bitnami
The same CVE-2023-42502 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Superset is an open-source data exploration and visualization platform. It provides a user-friendly interface for users to create and share interactive dashboards, charts, and reports. The vulnerability identified in Apache Superset allows an authenticated attacker with update datasets permission to change a dataset link to an untrusted site by spoofing the HTTP Host header. When users click on the manipulated dataset, they can be redirected to the malicious site, potentially leading to phishing attacks or other malicious activities.
Vulnerability Detail
The Apache Superset Open Redirect vulnerability (CVE-2023-42502) arises from a lack of proper validation of the dataset link. By exploiting this vulnerability, an attacker can modify the link to redirect users to an untrusted site. This can be achieved by manipulating the HTTP Host header. The impact of this vulnerability is moderate, as it requires an authenticated attacker with specific permissions. However, if successfully exploited, it can lead to users unknowingly visiting malicious websites and falling victim to various attacks. This vulnerability affects Apache Superset versions prior to 3.0.0.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "apache-superset==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
3.0.0
This is the first release that contains the fix.
pip install --upgrade "apache-superset==3.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can disable the ability for authenticated attackers to update datasets. By removing the update datasets permission for potentially malicious users, the risk of exploitation can be mitigated. However, this workaround may limit the functionality of Apache Superset for legitimate users who require the ability to update datasets. It is strongly advised to apply the official fix by upgrading to Apache Superset 3.0.0 or later.
Conclusion
The Apache Superset Open Redirect vulnerability (CVE-2023-42502) allows authenticated attackers to manipulate dataset links and redirect users to untrusted sites. This can lead to various malicious activities and poses a moderate risk. To mitigate this vulnerability, it is recommended to upgrade to Apache Superset version 3.0.0 or later. Users can also check if their application is affected using the Vulert playground at https://vulert.com/scanner. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-superset →
FAQ
Apache Superset is an open-source data exploration and visualization platform that allows users to create interactive dashboards, charts, and reports.
The impact of this vulnerability is moderate. If successfully exploited, an attacker can redirect users to untrusted sites, potentially leading to phishing attacks or other malicious activities.
Users of Apache Superset versions prior to 3.0.0 are affected by this vulnerability. Specifically, authenticated attackers with update datasets permission can exploit this vulnerability.
To fix this vulnerability, it is recommended to upgrade to Apache Superset version 3.0.0 or later. This version includes the necessary fixes and improvements to prevent the open redirect vulnerability.
As a temporary workaround, users can disable the ability for authenticated attackers to update datasets. However, it is strongly advised to apply the official fix by upgrading to Apache Superset 3.0.0 or later.
Related vulnerabilities
Recent vulnerabilities recorded for apache-superset.
