CVE-2021-41971: Apache Superset SQL Injection Vulnerability
Summary
CVE-2021-41971: Apache Superset up to and including 1.3.0 when configured with ENABLE_TEMPLATE_PROCESSING on (disabled by default) allowed SQL injection when a malicious authenticated user sends an http request with a custom URL. Affects apache-superset versions < 1.3.1. Fixed in 1.3.1. How to fix ↓
Also tracked for
- superset · Bitnami
The same CVE-2021-41971 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache Superset is an open-source data exploration and visualization platform. It provides a user-friendly interface for creating interactive dashboards and visualizations from various data sources. The vulnerability in Apache Superset up to and including version 1.3.0 occurs when the ENABLE_TEMPLATE_PROCESSING configuration option is enabled (disabled by default). This allows a malicious authenticated user to perform SQL injection by sending a custom URL via an HTTP request.
Vulnerability Detail
The SQL injection vulnerability in Apache Superset allows an attacker with authenticated access to execute arbitrary SQL queries. By crafting a malicious URL, an attacker can inject SQL code that gets executed by the Superset application. This can lead to unauthorized data access, data manipulation, or even remote code execution on the underlying database server. The impact of this vulnerability depends on the privileges of the targeted user and the sensitivity of the data stored in the database.
How To Fix
Latest published version: 6.1.0 as of 23 Oct 2026
pip install --upgrade "apache-superset==6.1.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.3.1
This is the first release that contains the fix.
pip install --upgrade "apache-superset==1.3.1"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a temporary workaround is to disable the ENABLE_TEMPLATE_PROCESSING configuration option in Apache Superset. This can be done by modifying the Superset configuration file and setting ENABLE_TEMPLATE_PROCESSING to 'False'. However, it is strongly advised to upgrade to the latest version as soon as possible to benefit from the comprehensive fix.
Conclusion
The SQL injection vulnerability in Apache Superset can lead to unauthorized data access, data manipulation, or even remote code execution. It is crucial to upgrade to the latest version (1.3.1 or later) or disable the ENABLE_TEMPLATE_PROCESSING configuration option as a temporary workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for apache-superset →
FAQ
Apache Superset is an open-source data exploration and visualization platform that allows users to create interactive dashboards and visualizations from various data sources.
SQL injection is a type of security vulnerability that occurs when an attacker can manipulate an SQL query by injecting malicious SQL code. This can lead to unauthorized access, data manipulation, or even remote code execution.
The SQL injection vulnerability in Apache Superset occurs when the ENABLE_TEMPLATE_PROCESSING configuration option is enabled. This allows a malicious authenticated user to send a custom URL with SQL code, which gets executed by the Superset application.
The potential consequences of this vulnerability include unauthorized data access, data manipulation, or even remote code execution on the underlying database server. The impact depends on the privileges of the targeted user and the sensitivity of the data stored in the database.
To fix the vulnerability, it is recommended to upgrade Apache Superset to version 1.3.1 or later. This ensures that the vulnerability is patched and the application is secure.
References
Related vulnerabilities
Recent vulnerabilities recorded for apache-superset.
