[<prev] [next>] [day] [month] [year] [list]
Message-ID: <fb095f41-42d9-84eb-f16f-6984258ffa8a@apache.org>
Date: Tue, 24 Feb 2026 09:45:40 +0000
From: Daniel Gaspar <dpgaspar@...che.org>
To: oss-security@...ts.openwall.com
Subject: CVE-2026-23984: Apache Superset: SQLLab Read-Only Bypass on
PostgreSQL
Severity:
Affected versions:
- Apache Superset 0.0.0 before 6.0.0
Description:
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection.
While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements.
This issue affects Apache Superset: before 6.0.0.
Users are recommended to upgrade to version 6.0.0, which fixes the issue.
Credit:
Trung Đức Lê (reporter)
Beto de Almeida (remediation developer)
References:
https://superset.apache.org
https://www.cve.org/CVERecord?id=CVE-2026-23984
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
