CVE-2021-28125: Apache Superset Open Redirect Vulnerability
Summary
CVE-2021-28125: Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. Affects apache-superset versions < 1.1.0. Fixed in 1.1.0. How to fix ↓
Also tracked for
The same CVE-2021-28125 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Superset is an open-source data exploration and visualization platform. It provides a web-based interface for users to create, explore, and share interactive dashboards and visualizations. The URL shortener functionality in Apache Superset allows users to create short URLs for dashboards. However, prior to version 1.1.0, it did not properly validate user input for open redirects, which could be exploited by a malicious user to create a short URL that redirects to a malicious website.
Vulnerability Detail
The Apache Superset vulnerability (CVE-2021-28125) allows an attacker to create a short URL that appears legitimate but actually redirects the user to a malicious website. This can be achieved by exploiting the lack of input validation in the URL shortener functionality. If a user clicks on the malicious short URL, they may be tricked into visiting a website that could potentially compromise their system or steal sensitive information. This vulnerability affects Apache Superset versions up to and including 1.0.1.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "apache-superset==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.1.0
This is the first release that contains the fix.
pip install --upgrade "apache-superset==1.1.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Conclusion
The Apache Superset Open Redirect Vulnerability (CVE-2021-28125) allows for the creation of malicious short URLs that can trick users into visiting harmful websites. To mitigate this risk, it is crucial to update Apache Superset to version 1.1.0 or later, which includes proper input validation for open redirects. Additionally, users can utilize the Vulert Playground at https://vulert.com/scanner to check if their Apache Superset installation is affected by this vulnerability. For further support, contact DevNack.com.
See every vulnerability recorded for apache-superset →
FAQ
You can use the Vulert Playground at Vulert Scanner to check if your Apache Superset installation is affected by this vulnerability. Simply enter your Pipfile.lock file, and Vulert will analyze it to identify any open-source vulnerabilities, including CVE-2021-28125.
At the time of this report, there are no known public exploits specifically targeting CVE-2021-28125 in Apache Superset. However, it is important to promptly update your installation to the latest version to prevent potential exploitation.
Unfortunately, there is no known temporary workaround for this vulnerability. It is recommended to prioritize updating Apache Superset to the latest version as soon as possible.
No, this vulnerability is not specific to any particular operating system. It affects Apache Superset installations regardless of the underlying operating system.
For further support on vulnerability remediation or any other security concerns, you can contact info@devnack.com. They can provide guidance and assistance in addressing the CVE-2021-28125 vulnerability in Apache Superset.
Related vulnerabilities
Recent vulnerabilities recorded for apache-superset.
