oss-security - CVE-2026-23980: Apache Superset: Improper Neutralization of Special Elements used in a SQL Command

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <62a401e5-221e-0fb5-161c-1b4b930abed6@apache.org>
Date: Tue, 24 Feb 2026 09:26:05 +0000
From: Daniel Gaspar <dpgaspar@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-23980: Apache Superset: Improper Neutralization of
 Special Elements used in a SQL Command 

Severity: 

Affected versions:

- Apache Superset 0.0.0 before 6.0.0

Description:

Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters.

This issue affects Apache Superset: before 6.0.0.

Users are recommended to upgrade to version 6.0.0, which fixes the issue.

Credit:

Pritam Chakkerwar (finder)
Dhanush Nayak (reporter)
Pedro Sousa (remediation developer)

References:

https://superset.apache.org
https://www.cve.org/CVERecord?id=CVE-2026-23980

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.