CVE-2021-44451: Apache Superset Password Leak Vulnerability
Summary
CVE-2021-44451: Apache Superset up to and including 1.3.2 allowed for registered database connections password leak for authenticated users. Affects apache-superset versions < 1.4.0. Fixed in 1.4.0. How to fix ↓
Also tracked for
- superset · Bitnami
The same CVE-2021-44451 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Apache Superset is an open-source data exploration and visualization platform. It allows users to connect to various databases, create interactive dashboards, and perform data analysis. The vulnerability in Apache Superset up to and including version 1.3.2 allows for the leakage of registered database connections passwords for authenticated users. This information can be accessed in a non-trivial way, potentially leading to unauthorized access to sensitive data.
Vulnerability Detail
The vulnerability in Apache Superset allows authenticated users to obtain the passwords of registered database connections. This can be exploited by an attacker with authenticated access to the platform to gain unauthorized access to the connected databases. The leak of passwords can lead to the exposure of sensitive data and compromise the security of the affected systems. The vulnerability has been assigned CVE-2021-44451 and is tracked as GHSA-hhm3-48h2-597v on GitHub.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "apache-superset==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.4.0
This is the first release that contains the fix.
pip install --upgrade "apache-superset==1.4.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of Apache Superset as soon as possible.
Conclusion
The password leak vulnerability in Apache Superset can lead to the exposure of sensitive data and unauthorized access to connected databases. Users should upgrade to version 1.4.0 or higher to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache-superset →
FAQ
Apache Superset is an open-source data exploration and visualization platform that allows users to connect to various databases, create interactive dashboards, and perform data analysis.
The vulnerability allows authenticated users to obtain the passwords of registered database connections, potentially leading to unauthorized access to sensitive data.
To fix this vulnerability, users should upgrade to Apache Superset version 1.4.0 or higher.
There is no known workaround for this vulnerability. It is recommended to upgrade to the latest version of Apache Superset.
More information about this vulnerability can be found in the Apache Superset advisory PYSEC-2022-36.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-superset.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
