VulertSecurity VulertSecurity

Vulnerability Database · PyPI · apache-superset · Version

apache-superset 1.3.1

1.3.1 is affected by 113 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 6.1.0.

Critical 5 High 19 Medium 82 Low 3 Unrated 4

All apache-superset versions & vulnerabilities → Search the database for this package →
Released 28 Sep 2021 Licence Apache-2.0 Also known from other sources 110 Newer releases 83 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

apache-superset 1.3.1 vulnerabilities

113 vulnerabilities cover apache-superset 1.3.1. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2024-53947: Apache Superset SQL Injection Vulnerability Due to Improper Authorization Checks 9.8 critical 4.1.0 07 Jul 2026
CVE-2024-53947: Apache Superset SQL Injection Vulnerability Due to Improper Authorization 9.8 low 4.1.0 09 Dec 2024
CVE-2022-27479: SQL Injection in Apache Superset 9.8 critical 1.4.2 14 Apr 2022
CVE-2022-27479: SQL injection in apache-superset 9.8 critical 1.4.2 14 Apr 2022
CVE-2023-49657: Apache Superset Stored XSS Vulnerability 9.6 critical 3.0.3 29 Jun 2026
CVE-2023-49657: Cross-site Scripting in Apache Superset 9.6 critical 3.0.3 23 Jan 2024
CVE-2023-27524: Apache Superset Default SECRET_KEY Vulnerability 8.9 high 2.1.0 07 Jul 2026
CVE-2023-27524: Apache Superset Missing Check for Default SECRET_KEY 8.9 high 2.1.0 24 Apr 2023
CVE-2025-27696: Apache Superset Ownership Takeover Vulnerability 8.8 high 4.1.2 07 Jul 2026
CVE-2022-43719: Apache Superset Cross-Site Request Forgery Vulnerability in Legacy REST API Endpoints 8.8 high 1.5.3 07 Jul 2026
CVE-2025-27696: Apache Superset Ownership Takeover Vulnerability 8.8 medium 4.1.2 13 May 2025
CVE-2022-43719: Apache Superset Cross-Site Request Forgery Vulnerability 8.8 high No fix published 16 Jan 2023
CVE-2023-49734: Apache Superset Incorrect Write Permissions Vulnerability 7.7 high 2.1.3 07 Jul 2026
CVE-2023-49734: Apache Superset Incorrect Write Permissions Vulnerability 7.7 high 2.1.3 19 Dec 2023
CVE-2023-40610: Apache Superset Elevation of Privilege Vulnerability 7.3 high 2.1.2 07 Jul 2026
Apache Superset - Elevation of Privilege (CVE-2023-40610) 7.3 high 2.1.2 28 Nov 2023
CVE-2026-23984: Apache Superset Read-Only Bypass via Improper Input Validation 7.1 high 6.0.0 13 Jul 2026
CVE-2026-23982: Apache Superset Improper Authorization Bypass for Low-Privileged Users 7.1 high 6.0.0 13 Jul 2026
CVE-2025-48912: Apache Superset Improper Authorization Bypass via SQL Injection 7.1 high 4.1.2 07 Jul 2026
CVE-2026-23982: Apache Superset Improper Authorization Bypass Vulnerability 7.1 high 6.0.0 24 Feb 2026
CVE-2026-23984: Apache Superset Read-Only Bypass via Improper Input Validation 7.1 high 6.0.0 24 Feb 2026
CVE-2025-48912: Apache Superset SQL Injection Vulnerability Leading to Unauthorized Data Access 7.1 high 4.1.2 30 May 2025
CVE-2024-34693: Apache Superset Arbitrary File Read Vulnerability 6.8 medium 3.1.3 07 Jul 2026
CVE-2024-34693: Apache Superset server arbitrary file read 6.8 medium 3.1.3 20 Jun 2024
CVE-2024-55633: Apache Superset SQLLab Improper Readonly Query Validation Vulnerability 6.5 medium 4.1.0 07 Jul 2026
CVE-2023-49736: Apache Superset SQL Injection Vulnerability 6.5 medium 2.1.3 07 Jul 2026
CVE-2023-46104: Apache Superset Uncontrolled Resource Consumption Vulnerability 6.5 medium 2.1.2 07 Jul 2026
CVE-2023-42504: Apache Superset Denial of Service Vulnerability Due to Resource Allocation Issues 6.5 medium 3.0.0 07 Jul 2026
CVE-2023-39265: Apache Superset Improper Input Validation Vulnerability 6.5 medium 2.1.1 07 Jul 2026
CVE-2023-30776: Apache Superset Sensitive Information Exposure Vulnerability 6.5 medium 2.1.0 07 Jul 2026
CVE-2023-25504: Apache Superset Server-Side Request Forgery Vulnerability 6.5 medium 2.1.0 07 Jul 2026
CVE-2024-55633: Apache Superset SQLLab Improper Readonly Query Validation Vulnerability 6.5 high 4.1.0 12 Dec 2024
Uncontrolled Resource Consumption in Apache Superset 6.5 medium 2.1.2 30 May 2024
CVE-2023-46104: Apache Superset uncontrolled resource consumption 6.5 medium 2.1.2 19 Dec 2023
CVE-2023-49736: Apache Superset SQL Injection Vulnerability 6.5 medium 2.1.3 19 Dec 2023
CVE-2023-42504: Apache Superset Allocation of Resources Without Limits or Throttling Vulnerability 6.5 medium 3.0.0 28 Nov 2023
CVE-2023-39265: Apache Superset Improper Input Validation vulnerability 6.5 medium No fix published 06 Sep 2023
CVE-2023-30776: Apache Superset Exposure of Sensitive Information 6.5 medium 2.1.0 06 Jul 2023
CVE-2023-25504: Apache Superset Server-Side Request Forgery vulnerability 6.5 medium 2.1.0 06 Jul 2023
CVE-2021-42250: Improper Encoding or Escaping of Output in Apache Superset 6.5 high 1.3.2 24 May 2022
CVE-2021-41972: Apache Superset - Database Connections Password Leak 6.5 high 1.3.2 24 May 2022
CVE-2021-44451: Insufficiently Protected Credentials in Apache Superset 6.5 high 1.4.0 02 Feb 2022
CVE-2023-40610: Apache Superset - Elevation of Privilege 6.3 medium 2.1.2 27 Nov 2023
CVE-2023-42502: Apache Superset Open Redirect Vulnerability 5.4 medium 3.0.0 07 Jul 2026
CVE-2023-36387: Apache Superset - Improper Default REST API Permission for Gamma Users 5.4 medium No fix published 07 Jul 2026
CVE-2022-43718: Apache Superset Cross-Site Scripting (XSS) Vulnerability 5.4 medium 1.5.3 07 Jul 2026
CVE-2022-43717: Apache Superset Cross-site Scripting Vulnerability 5.4 medium 1.5.3 07 Jul 2026
CVE-2022-41703: Apache Superset SQL Alchemy Connector SQL Injection Vulnerability 5.4 medium 1.5.3 07 Jul 2026
CVE-2022-43721: Apache Superset Open Redirect Vulnerability 5.4 medium 1.5.3 07 Jul 2026
CVE-2022-43720: Apache Superset Injection Vulnerability in CSS Template Management 5.4 medium 1.5.3 07 Jul 2026
CVE-2023-42502: Apache Superset Open Redirect vulnerability 5.4 medium 3.0.0 28 Nov 2023
CVE-2023-36387: Apache Superset Improper Default REST API Permission 5.4 medium No fix published 06 Sep 2023
CVE-2022-43718: Apache Superset Cross-Site Scripting (XSS) Vulnerability 5.4 medium No fix published 16 Jan 2023
CVE-2022-43717: Apache Superset Cross-site Scripting Vulnerability 5.4 medium No fix published 16 Jan 2023
CVE-2022-41703: SQL Injection Vulnerability in Apache Superset's SQL Alchemy Connector 5.4 medium No fix published 16 Jan 2023
CVE-2022-43721: Apache Superset Open Redirect vulnerability 5.4 medium No fix published 16 Jan 2023
CVE-2022-43720: Apache Superset Injection Vulnerability 5.4 medium No fix published 16 Jan 2023
CVE-2026-23969: Apache Superset Incomplete DISALLOWED_SQL_FUNCTIONS Default List for ClickHouse Engine 5.3 medium 4.1.2 13 Jul 2026
CVE-2026-23980: Apache Superset Error-Based SQL Injection Vulnerability 5.3 medium 6.0.0 13 Jul 2026
CVE-2025-55673: Apache Superset Data Query Exposes Database Schema to Low-Privileged Users 5.3 medium 4.1.3.post1 07 Jul 2026
CVE-2025-55672: Apache Superset Chart Visualization Stored XSS Vulnerability 5.3 medium 5.0.0 07 Jul 2026
CVE-2025-55674: Apache Superset SQL Function Bypass Vulnerability 5.3 medium 5.0.0 07 Jul 2026
CVE-2025-55675: Apache Superset Improper Access Control Vulnerability 5.3 medium 5.0.0 07 Jul 2026
CVE-2024-53948: Apache Superset Error Verbosity Exposes Metadata in Analytics Databases 5.3 medium 4.1.0 07 Jul 2026
CVE-2022-45438: Apache Superset Improper Access Control Vulnerability 5.3 medium 1.5.3 07 Jul 2026
CVE-2026-23969: Apache Superset Incomplete DISALLOWED_SQL_FUNCTIONS Default List for ClickHouse Engine 5.3 medium 4.1.2 24 Feb 2026
CVE-2026-23980: Apache Superset Error-Based SQL Injection Vulnerability 5.3 medium 6.0.0 24 Feb 2026
CVE-2025-55673: Apache Superset Improper Disclosure of Database Schema Information to Guest Users 5.3 medium 4.1.3.post1 14 Aug 2025
CVE-2025-55672: Apache Superset Stored XSS Vulnerability in Chart Visualization 5.3 medium 5.0.0 14 Aug 2025
CVE-2025-55674: Apache Superset SQL Function Bypass Vulnerability 5.3 medium 5.0.0 14 Aug 2025
CVE-2025-55675: Apache Superset Improper Access Control Vulnerability 5.3 medium 5.0.0 14 Aug 2025
CVE-2024-53948: Apache Superset Error Verbosity Exposes Metadata in Analytics Databases 5.3 medium 4.1.0 09 Dec 2024
CVE-2022-45438: Apache Superset Improper Access Control 5.3 medium No fix published 16 Jan 2023
CVE-2024-24779: Apache Superset Improper Data Authorization Vulnerability 5.0 medium 3.0.4 07 Jul 2026
CVE-2023-27523: Apache Superset Improper Data Authorization Vulnerability 5.0 medium 2.1.1 07 Jul 2026
CVE-2024-24779: Apache Superset - Improper data authorization when creating a new dataset 5.0 medium 3.0.4 28 Feb 2024
CVE-2023-27523: Apache Superset Improper Data Authorization 5.0 medium No fix published 06 Sep 2023
CVE-2024-24773: Apache Superset SQL Statement Validation Flaw Leads to Unauthorized Data Access 4.9 medium 3.0.4 07 Jul 2026
CVE-2024-24773: Apache Superset - Improper validation of SQL statements allows for unauthorized access to data 4.9 medium 3.0.4 28 Feb 2024
CVE-2024-39887: Apache Superset SQL Injection Vulnerability Due to Improper Authorization 4.3 medium 4.0.2 07 Jul 2026
CVE-2024-28148: Apache Superset Incorrect Authorization Vulnerability 4.3 medium 3.1.2 07 Jul 2026
CVE-2024-26016: Apache Superset Improper Authorization Validation on Dashboards and Charts Import 4.3 medium 3.0.4 07 Jul 2026
CVE-2024-27315: Apache Superset Improper Error Handling on Alerts 4.3 medium 3.0.4 07 Jul 2026
CVE-2024-24772: Apache Superset Improper SQL Neutralization Vulnerability 4.3 medium 3.0.4 07 Jul 2026
CVE-2023-42505: Apache Superset Sensitive Information Exposure Vulnerability 4.3 medium 3.0.0 07 Jul 2026
CVE-2023-42501: Apache Superset Incorrect Default Permissions Vulnerability 4.3 medium 2.1.2 07 Jul 2026
CVE-2023-43701: Apache Superset Cross-site Scripting Vulnerability 4.3 medium 2.1.2 07 Jul 2026
CVE-2023-36388: Apache Superset Server Side Request Forgery Vulnerability 4.3 medium 2.1.1 07 Jul 2026
CVE-2023-32672: Apache Superset Incorrect Authorization Check Vulnerability 4.3 medium 2.1.1 07 Jul 2026
CVE-2023-27526: Apache Superset Import Charts Feature Vulnerability 4.3 medium 2.1.1 07 Jul 2026
CVE-2023-39264: Apache Superset Exposes Internal Traces on REST API Endpoints 4.3 medium 2.1.1 07 Jul 2026
CVE-2023-27525: Apache Superset Improper Authorization Vulnerability 4.3 medium 2.1.0 07 Jul 2026
CVE-2021-37839: Apache Superset Metadata Exposure Vulnerability 4.3 medium 1.5.1 06 Jul 2026
CVE-2024-39887: Apache Superset SQL Injection Vulnerability 4.3 medium 4.0.2 16 Jul 2024
CVE-2024-28148: Apache Superset Incorrect Authorization vulnerability 4.3 medium 3.1.2 07 May 2024
CVE-2024-26016: Apache Superset - Improper authorization validation on dashboards and charts import 4.3 medium 3.0.4 28 Feb 2024
CVE-2024-24772: Apache Superset - Improper Neutralization of custom SQL on embedded context 4.3 medium 3.0.4 28 Feb 2024
CVE-2024-27315: Apache Superset - Improper error handling on alerts 4.3 medium 3.0.4 28 Feb 2024
CVE-2023-42505: Apache Superset Exposure of Sensitive Information to an Unauthorized Actor 4.3 medium 3.0.0 28 Nov 2023
CVE-2023-42501: Apache Superset Incorrect Default Permissions 4.3 medium 2.1.2 27 Nov 2023
CVE-2023-43701: Apache Superset Cross-site Scripting vulnerability 4.3 medium 2.1.2 27 Nov 2023
CVE-2023-32672: Incorrect Authorization Check in Apache Superset 4.3 medium No fix published 06 Sep 2023
CVE-2023-27526: Apache Superset - Incorrect Resource Creation via Import Charts Feature 4.3 medium No fix published 06 Sep 2023
CVE-2023-36388: Apache Superset Server Side Request Forgery vulnerability 4.3 medium No fix published 06 Sep 2023
CVE-2023-39264: Apache Superset exposes internal traces on REST API endpoints 4.3 medium No fix published 06 Sep 2023
CVE-2023-27525: Apache Superset Improper Authorization 4.3 medium No fix published 17 Apr 2023
CVE-2021-37839: Apache Superset Metadata Access Control Bypass 4.3 medium 1.5.1 07 Jul 2022
CVE-2026-23983: Apache Superset Sensitive Data Exposure Vulnerability 2.3 low 6.0.0 13 Jul 2026
CVE-2026-23983: Apache Superset Sensitive Data Exposure Vulnerability 2.3 low 6.0.0 24 Feb 2026
CVE-2022-27479: SQL Injection in Apache Superset N/A unrated 1.4.2 13 Apr 2022
CVE-2021-44451: Apache Superset Password Leak Vulnerability N/A unrated 1.4.0 01 Feb 2022
CVE-2021-42250: Apache Superset Improper Output Neutralization N/A unrated 1.3.2 17 Nov 2021
CVE-2021-41972: Apache Superset Database Connections Password Leak N/A unrated 1.3.2 12 Nov 2021

Looking for another version, or everything Vulert holds for apache-superset?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About apache-superset 1.3.1

Is apache-superset 1.3.1 vulnerable?

Yes. 113 vulnerabilities in the Vulert database cover apache-superset 1.3.1: 5 critical, 19 high, 82 medium and 3 low, plus 4 not yet rated. The upgrade Vulert recommends is 6.1.0, and each entry above names the fixed version to move to.

Which version of apache-superset should I use instead of 1.3.1?

6.1.0 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 1.3.1 the latest release of apache-superset?

No. 1.3.1 was published 28 Sep 2021, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor apache-superset for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the apache-superset version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.