CVE-2021-41972: Apache Superset - Database Connections Password Leak
Summary
CVE-2021-41972: Apache Superset allowed for database connections password leak for authenticated users. Affects apache-superset versions < 1.3.2. Fixed in 1.3.2. How to fix ↓
Also tracked for
- superset · Bitnami
The same CVE-2021-41972 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Superset is an open-source data exploration and visualization platform. It provides a user-friendly interface for creating interactive dashboards and visualizations from various data sources. The platform allows users to connect to databases and perform queries to retrieve and analyze data. However, a vulnerability in Apache Superset up to and including version 1.3.1 allowed for the leakage of database connection passwords for authenticated users. This vulnerability could be exploited by attackers to gain unauthorized access to sensitive information stored in the connected databases.
Vulnerability Detail
The vulnerability in Apache Superset allowed authenticated users to access database connection passwords in a non-trivial way. This means that even though users were authorized to access the platform, they could retrieve the passwords used to establish connections with databases. This information could be used by attackers to gain unauthorized access to the connected databases and potentially extract or manipulate sensitive data. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "apache-superset==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.2
This is the first release that contains the fix.
pip install --upgrade "apache-superset==1.3.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid storing database connection passwords in Apache Superset. Instead, they can use external authentication mechanisms or configure the platform to retrieve passwords from secure storage systems. By eliminating the storage of passwords within Apache Superset, the risk of password leakage is mitigated. However, this workaround may require additional configuration and setup.
Conclusion
The vulnerability in Apache Superset allowed for the leakage of database connection passwords, posing a risk of unauthorized access to connected databases. Users should upgrade to version 1.3.2 or later to fix the vulnerability. In the meantime, a temporary workaround is available to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for apache-superset →
FAQ
Apache Superset is an open-source data exploration and visualization platform that allows users to create interactive dashboards and visualizations from various data sources.
The vulnerability allows authenticated users to access database connection passwords, which can be used to gain unauthorized access to connected databases and potentially extract or manipulate sensitive data.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
To fix this vulnerability, users should upgrade their Apache Superset installation to version 1.3.2 or later.
A temporary workaround is to avoid storing database connection passwords in Apache Superset and use external authentication mechanisms or secure storage systems instead.
Related vulnerabilities
Recent vulnerabilities recorded for apache-superset.
