CVE-2026-23984: Apache Superset Read-Only Bypass via Improper Input Validation
Summary
CVE-2026-23984: Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections. Affects apache-superset versions < 6.0.0. Fixed in 6.0.0. How to fix ↓
Also tracked for
- superset · Bitnami
The same CVE-2026-23984 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Superset is an open-source data visualization and exploration platform designed to help users analyze and visualize data from various sources. It provides a rich set of features, including a SQL editor, dashboards, and data exploration capabilities. However, prior to version 6.0.0, Superset had a vulnerability that allowed authenticated users with SQLLab access to bypass read-only restrictions when connecting to PostgreSQL databases.
Vulnerability Detail
The vulnerability arises from improper input validation in Apache Superset, which fails to adequately enforce read-only access on PostgreSQL connections. Although the system is designed to block standard Data Manipulation Language (DML) statements such as INSERT, UPDATE, and DELETE, it does not effectively detect these operations when they are embedded in specially crafted SQL statements. This oversight can lead to unauthorized data modifications, posing a significant risk to data integrity and security.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "apache-superset==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
6.0.0
This is the first release that contains the fix.
pip install --upgrade "apache-superset==6.0.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to SQLLab for authenticated users until the upgrade is completed. This can be done by modifying user permissions in the Superset settings to prevent unauthorized access to SQLLab features.
Conclusion
In summary, the vulnerability identified as CVE-2026-23984 in Apache Superset allows authenticated users to bypass read-only restrictions on PostgreSQL connections due to improper input validation. Users are strongly advised to upgrade to version 6.0.0 or later to mitigate this risk. For those unable to upgrade immediately, restricting access to SQLLab can serve as a temporary measure.
See every vulnerability recorded for apache-superset →
FAQ
The CVSS score of this vulnerability is 7.1, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
If exploited, this vulnerability can allow unauthorized users to modify data in a read-only database, compromising data integrity and security.
Yes, upgrading to Apache Superset version 6.0.0 or later will resolve this vulnerability.
If an immediate upgrade is not possible, consider restricting access to SQLLab for users until the upgrade can be performed.
Related vulnerabilities
Recent vulnerabilities recorded for apache-superset.
