CVE-2025-55673: Apache Superset Metadata Exposure in Embedded Charts
Summary
CVE-2025-55673: Apache Superset: Metadata exposure in embedded charts. Affects superset versions < 4.1.3. Fixed in 4.1.3. How to fix ↓
Also tracked for
- apache-superset · PyPI
- apache-superset · PyPI
The same CVE-2025-55673 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Superset is an open-source data visualization and exploration platform designed to help users create interactive dashboards and charts. It supports a wide range of data sources and provides a user-friendly interface for data analysis. However, a vulnerability has been identified that allows guest users to access sensitive database schema information through embedded charts.
Vulnerability Detail
The vulnerability arises when a guest user accesses a chart in Apache Superset. The API response from the /chart/data endpoint includes a query field that improperly discloses underlying database schema information, such as table names, to low-privileged guest users. This exposure can lead to unauthorized access to sensitive data and potentially compromise the integrity of the database.
How To Fix
Minimum fixed version
4.1.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, it is recommended to restrict guest user access to sensitive charts or disable guest access entirely until the upgrade can be performed.
Conclusion
In summary, CVE-2025-55673 is a significant vulnerability in Apache Superset that exposes sensitive database schema information to guest users. Upgrading to version 4.1.3 or later is essential to mitigate this risk. Users should also consider temporary workarounds to protect their data until the upgrade can be completed.
See every vulnerability recorded for superset →
FAQ
CVE-2025-55673 is a vulnerability in Apache Superset that allows guest users to access sensitive database schema information through embedded charts.
This vulnerability can lead to unauthorized access to sensitive data, potentially compromising the integrity of your database.
The vulnerability affects all versions of Apache Superset prior to 4.1.3.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot upgrade immediately, consider restricting guest user access to sensitive charts or disabling guest access until the upgrade can be performed.
References
Related vulnerabilities
Recent vulnerabilities recorded for superset.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
