CVE-2020-13952: Apache Superset - Information Disclosure and Bypass of Security Controls
Summary
CVE-2020-13952: In the course of work on the open source project it was discovered that authenticated users running queries against Hive and Presto database engines could access information via a number of templated fields including the... Affects apache-superset versions < 0.37.2. Fixed in 0.37.2. How to fix ↓
Also tracked for
- superset · Bitnami
The same CVE-2020-13952 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Superset is an open-source data exploration and visualization platform that allows users to create interactive dashboards and perform data analysis. It supports various database engines, including Hive and Presto. Users can run queries against these engines to retrieve and manipulate data. However, a vulnerability has been discovered in Apache Superset versions prior to 0.37.2 that allows authenticated users to access sensitive information and bypass security controls.
Vulnerability Detail
The vulnerability allows authenticated users to access information through templated fields in queries against Hive and Presto database engines. This includes the contents of query description metadata database, the hashed version of the authenticated users' password, and access to connection information, including the plaintext password for the current connection. Additionally, users can run arbitrary methods on the database connection object for the Presto or Hive connection, bypassing internal security controls within Superset. This vulnerability poses a risk of unauthorized access to sensitive data and potential privilege escalation.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "apache-superset==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.37.2
This is the first release that contains the fix.
pip install --upgrade "apache-superset==0.37.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to Apache Superset version 0.37.2 or later.
Conclusion
The vulnerability in Apache Superset versions prior to 0.37.2 allows authenticated users to access sensitive information and bypass security controls. To mitigate this risk, it is recommended to upgrade to Apache Superset version 0.37.2 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-superset →
FAQ
Apache Superset is an open-source data exploration and visualization platform.
All Apache Superset versions prior to 0.37.2 are affected.
Authenticated users can access query description metadata, hashed passwords, connection information, and run arbitrary methods on the database connection object.
The vulnerability poses a risk of unauthorized access to sensitive data and potential privilege escalation.
No, there is no known workaround. It is crucial to upgrade to the fixed version of Apache Superset.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-superset.
