CVE-2025-55673: Apache Superset Improper Disclosure of Database Schema Information to Guest Users
Summary
CVE-2025-55673: When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. Affects apache-superset versions < 4.1.3.post1. Fixed in 4.1.3.post1. How to fix ↓
Also tracked for
- superset · Bitnami
The same CVE-2025-55673 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Superset is an open-source data visualization and exploration platform designed to help users create interactive dashboards and charts. It supports a wide range of data sources and provides features such as SQL editing, chart creation, and data exploration. However, a vulnerability has been identified that affects versions prior to 4.1.3, allowing low-privileged guest users to access sensitive database schema information.
Vulnerability Detail
The vulnerability arises when a guest user accesses a chart in Apache Superset. The API response from the /chart/data endpoint improperly includes a 'query' field in its payload, which reveals underlying database schema information, such as table names. This exposure can lead to unauthorized access to sensitive data and potentially compromise the security of the database.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "apache-superset==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
4.1.3.post1
This is the first release that contains the fix.
pip install --upgrade "apache-superset==4.1.3.post1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider restricting guest user access to sensitive charts or disabling guest access entirely until the upgrade can be performed.
Conclusion
In summary, CVE-2025-55673 is a moderate severity vulnerability in Apache Superset that allows guest users to improperly access database schema information. Users are strongly advised to upgrade to version 4.1.3.post1 or later to mitigate this risk. For those unable to upgrade immediately, implementing access restrictions can serve as a temporary solution.
See every vulnerability recorded for apache-superset →
FAQ
CVE-2025-55673 is a vulnerability in Apache Superset that allows low-privileged guest users to access sensitive database schema information.
Versions of Apache Superset prior to 4.1.3 are affected by this vulnerability.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
If an immediate upgrade is not possible, consider restricting guest user access to sensitive charts or disabling guest access as a temporary measure.
The potential risks include unauthorized access to sensitive database schema information, which could lead to further exploitation or data breaches.
Related vulnerabilities
Recent vulnerabilities recorded for apache-superset.
