CVE-2021-41971: Apache Superset SQL Injection Vulnerability
Summary
CVE-2021-41971: Apache Superset SQL Injection when template processing is enabled. Affects apache-superset versions < 1.3.1. Fixed in 1.3.1. How to fix ↓
Also tracked for
- superset · Bitnami
The same CVE-2021-41971 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Superset is an open-source data exploration and visualization platform. It provides a user-friendly interface for creating interactive dashboards and visualizations from various data sources. The vulnerability in Apache Superset up to and including version 1.3.0, when configured with ENABLE_TEMPLATE_PROCESSING, allows for SQL injection attacks. By sending a custom URL, a malicious authenticated user can inject arbitrary SQL queries into the application.
Vulnerability Detail
The SQL injection vulnerability in Apache Superset can be exploited by an authenticated user with malicious intent. By crafting a custom URL, the attacker can inject SQL queries into the application's database. This can lead to unauthorized access, data leakage, data manipulation, or even remote code execution. The vulnerability arises when the ENABLE_TEMPLATE_PROCESSING configuration option is enabled, which is disabled by default. It is important to note that this vulnerability only affects versions up to and including 1.3.0 of Apache Superset.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "apache-superset==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.1
This is the first release that contains the fix.
pip install --upgrade "apache-superset==1.3.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the ENABLE_TEMPLATE_PROCESSING configuration option manually. This can be done by modifying the Superset configuration file and setting the ENABLE_TEMPLATE_PROCESSING option to 'False'. Here is an example of how the configuration file can be modified:
[feature_flags]
ENABLE_TEMPLATE_PROCESSING = False
By applying this workaround, the SQL injection vulnerability can be mitigated until the upgrade to a fixed version is performed.
Conclusion
The SQL injection vulnerability in Apache Superset up to and including version 1.3.0 can be exploited by authenticated users to inject arbitrary SQL queries. To mitigate this vulnerability, it is crucial to upgrade to Apache Superset version 1.3.1 or later and disable the ENABLE_TEMPLATE_PROCESSING configuration option. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-superset →
FAQ
Apache Superset is an open-source data exploration and visualization platform that allows users to create interactive dashboards and visualizations from various data sources.
SQL injection is a type of security vulnerability where an attacker can insert malicious SQL code into a query, potentially gaining unauthorized access to the database or manipulating data.
The SQL injection vulnerability in Apache Superset occurs when the ENABLE_TEMPLATE_PROCESSING configuration option is enabled. This allows an authenticated user to send a custom URL with malicious SQL queries, which can be executed by the application.
The potential consequences of this vulnerability include unauthorized access to sensitive data, data leakage, data manipulation, and even remote code execution, depending on the attacker's intentions and the application's security measures.
To fix the SQL injection vulnerability, it is recommended to upgrade to Apache Superset version 1.3.1 or later. Additionally, ensure that the ENABLE_TEMPLATE_PROCESSING configuration option is disabled in the Superset configuration file.
Related vulnerabilities
Recent vulnerabilities recorded for apache-superset.
