VulertSecurity VulertSecurity

Vulnerability Database · PyPI · apache-superset · Version

apache-superset 4.1.1

4.1.1 is affected by 38 vulnerabilities.

The vulnerabilities that cover this exact version are listed below with the fixed version to move to. The upgrade Vulert recommends: 6.1.0.

Critical 0 High 8 Medium 28 Low 2 Unrated 0

All apache-superset versions & vulnerabilities → Search the database for this package →
Released 20 Nov 2024 Licence non-standard Also known from other sources 22 Newer releases 83 Database updated 23/Oct/2026

Release and licence data published by PyPI. Licence information is not legal advice.

Concerned about your application's security?

Vulert continues monitoring your dependencies and alerts you when new vulnerabilities are disclosed. No installation and no source-code access required.

01 Vulnerabilities affecting this version

apache-superset 4.1.1 vulnerabilities

38 vulnerabilities cover apache-superset 4.1.1. Scroll the table for all of them, or open the full list in the database.

Vulnerability Severity Fixed version Disclosed
CVE-2025-27696: Apache Superset Ownership Takeover Vulnerability 8.8 high 4.1.2 07 Jul 2026
CVE-2025-27696: Apache Superset Ownership Takeover Vulnerability 8.8 medium 4.1.2 13 May 2025
CVE-2022-43719: Apache Superset Cross-Site Request Forgery Vulnerability 8.8 high No fix published 16 Jan 2023
CVE-2026-23984: Apache Superset Read-Only Bypass via Improper Input Validation 7.1 high 6.0.0 13 Jul 2026
CVE-2026-23982: Apache Superset Improper Authorization Bypass for Low-Privileged Users 7.1 high 6.0.0 13 Jul 2026
CVE-2025-48912: Apache Superset Improper Authorization Bypass via SQL Injection 7.1 high 4.1.2 07 Jul 2026
CVE-2026-23984: Apache Superset Read-Only Bypass via Improper Input Validation 7.1 high 6.0.0 24 Feb 2026
CVE-2026-23982: Apache Superset Improper Authorization Bypass Vulnerability 7.1 high 6.0.0 24 Feb 2026
CVE-2025-48912: Apache Superset SQL Injection Vulnerability Leading to Unauthorized Data Access 7.1 high 4.1.2 30 May 2025
CVE-2023-39265: Apache Superset Improper Input Validation vulnerability 6.5 medium No fix published 06 Sep 2023
CVE-2023-36387: Apache Superset - Improper Default REST API Permission for Gamma Users 5.4 medium No fix published 07 Jul 2026
CVE-2023-36387: Apache Superset Improper Default REST API Permission 5.4 medium No fix published 06 Sep 2023
CVE-2022-43718: Apache Superset Cross-Site Scripting (XSS) Vulnerability 5.4 medium No fix published 16 Jan 2023
CVE-2022-43717: Apache Superset Cross-site Scripting Vulnerability 5.4 medium No fix published 16 Jan 2023
CVE-2022-41703: SQL Injection Vulnerability in Apache Superset's SQL Alchemy Connector 5.4 medium No fix published 16 Jan 2023
CVE-2022-43720: Apache Superset Injection Vulnerability 5.4 medium No fix published 16 Jan 2023
CVE-2022-43721: Apache Superset Open Redirect vulnerability 5.4 medium No fix published 16 Jan 2023
CVE-2026-23980: Apache Superset Error-Based SQL Injection Vulnerability 5.3 medium 6.0.0 13 Jul 2026
CVE-2026-23969: Apache Superset Incomplete DISALLOWED_SQL_FUNCTIONS Default List for ClickHouse Engine 5.3 medium 4.1.2 13 Jul 2026
CVE-2025-55675: Apache Superset Improper Access Control Vulnerability 5.3 medium 5.0.0 07 Jul 2026
CVE-2025-55674: Apache Superset SQL Function Bypass Vulnerability 5.3 medium 5.0.0 07 Jul 2026
CVE-2025-55673: Apache Superset Data Query Exposes Database Schema to Low-Privileged Users 5.3 medium 4.1.3.post1 07 Jul 2026
CVE-2025-55672: Apache Superset Chart Visualization Stored XSS Vulnerability 5.3 medium 5.0.0 07 Jul 2026
CVE-2026-23969: Apache Superset Incomplete DISALLOWED_SQL_FUNCTIONS Default List for ClickHouse Engine 5.3 medium 4.1.2 24 Feb 2026
CVE-2026-23980: Apache Superset Error-Based SQL Injection Vulnerability 5.3 medium 6.0.0 24 Feb 2026
CVE-2025-55673: Apache Superset Improper Disclosure of Database Schema Information to Guest Users 5.3 medium 4.1.3.post1 14 Aug 2025
CVE-2025-55672: Apache Superset Stored XSS Vulnerability in Chart Visualization 5.3 medium 5.0.0 14 Aug 2025
CVE-2025-55674: Apache Superset SQL Function Bypass Vulnerability 5.3 medium 5.0.0 14 Aug 2025
CVE-2025-55675: Apache Superset Improper Access Control Vulnerability 5.3 medium 5.0.0 14 Aug 2025
CVE-2022-45438: Apache Superset Improper Access Control 5.3 medium No fix published 16 Jan 2023
CVE-2023-27523: Apache Superset Improper Data Authorization 5.0 medium No fix published 06 Sep 2023
CVE-2023-32672: Incorrect Authorization Check in Apache Superset 4.3 medium No fix published 06 Sep 2023
CVE-2023-27526: Apache Superset - Incorrect Resource Creation via Import Charts Feature 4.3 medium No fix published 06 Sep 2023
CVE-2023-36388: Apache Superset Server Side Request Forgery vulnerability 4.3 medium No fix published 06 Sep 2023
CVE-2023-39264: Apache Superset exposes internal traces on REST API endpoints 4.3 medium No fix published 06 Sep 2023
CVE-2023-27525: Apache Superset Improper Authorization 4.3 medium No fix published 17 Apr 2023
CVE-2026-23983: Apache Superset Sensitive Data Exposure Vulnerability 2.3 low 6.0.0 13 Jul 2026
CVE-2026-23983: Apache Superset Sensitive Data Exposure Vulnerability 2.3 low 6.0.0 24 Feb 2026

Looking for another version, or everything Vulert holds for apache-superset?

All versions → Full vulnerability list →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →

Questions

About apache-superset 4.1.1

Is apache-superset 4.1.1 vulnerable?

Yes. 38 vulnerabilities in the Vulert database cover apache-superset 4.1.1: 0 critical, 8 high, 28 medium and 2 low. The upgrade Vulert recommends is 6.1.0, and each entry above names the fixed version to move to.

Which version of apache-superset should I use instead of 4.1.1?

6.1.0 is the version Vulert recommends for this release line. The version table on the package page lists every release with the vulnerabilities recorded against it.

Is 4.1.1 the latest release of apache-superset?

No. 4.1.1 was published 20 Nov 2024, and newer releases exist. Newer is not automatically safer — the version table on the package page shows what each release carries.

How do I monitor apache-superset for upcoming vulnerabilities?

Upload the manifest or SBOM for your application at vulert.com/scanner and Vulert keeps checking the apache-superset version you actually run against new disclosures, then alerts you when one affects it. There is no installation and no source-code access required.