CVE-2026-23980: Apache Superset Error-Based SQL Injection Vulnerability
Summary
CVE-2026-23980: Apache Superset allows privileged users to conduct error-based SQL Injection. Affects apache-superset versions < 6.0.0. Fixed in 6.0.0. How to fix ↓
Also tracked for
- superset · Bitnami
The same CVE-2026-23980 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Superset is an open-source data visualization and business intelligence tool that allows users to create interactive dashboards and explore data through a web interface. It supports various data sources and provides features like data exploration, visualization, and sharing insights. However, prior to version 6.0.0, Superset is vulnerable to an error-based SQL injection, which can be exploited by authenticated users with read access.
Vulnerability Detail
The vulnerability arises from improper neutralization of special elements used in SQL commands, specifically in the sqlExpression or where parameters. This flaw allows authenticated users to manipulate SQL queries, potentially leading to unauthorized data access or exposure of sensitive information. The issue is particularly concerning as it can be exploited by users with minimal privileges, making it a significant security risk for organizations using affected versions of Apache Superset.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "apache-superset==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.0.0
This is the first release that contains the fix.
pip install --upgrade "apache-superset==6.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is advisable to limit access to the Superset application to trusted users only, until the upgrade can be performed. Additionally, consider implementing web application firewalls (WAF) to help mitigate SQL injection attacks.
Conclusion
In summary, CVE-2026-23980 is a significant vulnerability in Apache Superset that allows authenticated users to perform error-based SQL injection. Users are strongly advised to upgrade to version 6.0.0 or later to mitigate this risk. Implementing access controls and using web application firewalls can provide temporary protection until the upgrade is completed.
See every vulnerability recorded for apache-superset →
FAQ
CVE-2026-23980 is a vulnerability in Apache Superset that allows authenticated users to conduct error-based SQL injection, potentially leading to unauthorized data access.
The vulnerability affects all versions of Apache Superset prior to 6.0.0.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate upgrade is not possible, restrict access to the application and consider using a web application firewall to mitigate potential attacks.
The CVSS score of this vulnerability is 5.3, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for apache-superset.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
