HTTP/2 301
server: Apache
location: https://superset.apache.org/docs/security/cves/
content-type: text/html; charset=iso-8859-1
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
age: 0
date: Thu, 25 Dec 2025 17:15:37 GMT
x-served-by: cache-hel1410032-HEL, cache-bom-vanm7210087-BOM
x-cache: MISS, MISS
x-cache-hits: 0, 0
x-timer: S1766682937.181364,VS0,VE401
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 255
HTTP/2 200
server: Apache
last-modified: Tue, 23 Dec 2025 23:26:18 GMT
etag: "92ca-646a6dee3d0f7-gzip"
content-encoding: gzip
access-control-allow-origin: *
content-security-policy: default-src data: blob: 'self' *.apache.org widget.kapa.ai *.githubusercontent.com *.scarf.sh *.googleapis.com *.google.com *.run.app *.gstatic.com *.github.com *.algolia.net *.algolianet.com 'unsafe-inline' 'unsafe-eval'; frame-src *; frame-ancestors 'self' *.google.com https://sidebar.bugherd.com; form-action 'self'; worker-src blob:; img-src 'self' blob: data: https:; font-src 'self'; object-src 'none'
content-type: text/html
via: 1.1 varnish, 1.1 varnish
accept-ranges: bytes
age: 0
date: Thu, 25 Dec 2025 17:15:38 GMT
x-served-by: cache-hel1410026-HEL, cache-bom-vanm7210087-BOM
x-cache: HIT, MISS
x-cache-hits: 4, 0
x-timer: S1766682938.600022,VS0,VE433
vary: Accept-Encoding
strict-transport-security: max-age=31536000; includeSubDomains; preload
content-length: 8640
CVEs fixed by release | Superset
This is unreleased documentation for Superset Next version.
Version: Next Version 5.0.0
| CVE | Title | Affected |
|---|
| CVE-2025-55673 | Exposure of Sensitive Information to an Unauthorized Actor | < 5.0.0 |
| CVE-2025-55674 | Improper Neutralization of Special Elements used in an SQL Command | < 5.0.0 |
| CVE-2025-55675 | Improper Access Control leading to Information Disclosure | < 5.0.0 |
Version 4.1.3
| CVE | Title | Affected |
|---|
| CVE-2025-55672 | Improper Neutralization of Input During Web Page Generation | < 4.1.3 |
Version 4.1.2
| CVE | Title | Affected |
|---|
| CVE-2025-27696 | Improper authorization leading to resource ownership takeover | < 4.1.2 |
| CVE-2025-48912 | Improper authorization bypass on row level security via SQL Injection | < 4.1.2 |
Version 4.1.0
| CVE | Title | Affected |
|---|
| CVE-2024-53947 | Improper SQL authorisation, parse for specific postgres functions | < 4.1.0 |
| CVE-2024-53948 | Error verbosity exposes metadata in analytics databases | < 4.1.0 |
| CVE-2024-53949 | Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled | < 4.1.0 |
| CVE-2024-55633 | SQLLab Improper readonly query validation allows unauthorized write access | < 4.1.0 |
Version 4.0.2
| CVE | Title | Affected |
|---|
| CVE-2024-39887 | Improper SQL authorization | < 4.0.1 |
Version 3.1.3, 4.0.1
| CVE | Title | Affected |
|---|
| CVE-2024-34693 | Server arbitrary file read | < 3.1.3, >= 4.0.0, < 4.0.1 |
Version 3.1.2
| CVE | Title | Affected |
|---|
| CVE-2024-28148 | Incorrect datasource authorization on explore REST API | < 3.1.2 |
Version 3.0.4, 3.1.1
| CVE | Title | Affected |
|---|
| CVE-2024-27315 | Improper error handling on alerts | < 3.0.4, >= 3.1.0, < 3.1.1 |
| CVE-2024-24773 | Improper validation of SQL statements allows for unauthorized access to data | < 3.0.4, >= 3.1.0, < 3.1.1 |
| CVE-2024-24772 | Improper Neutralisation of custom SQL on embedded context | < 3.0.4, >= 3.1.0, < 3.1.1 |
| CVE-2024-24779 | Improper data authorization when creating a new dataset | < 3.0.4, >= 3.1.0, < 3.1.1 |
| CVE-2024-26016 | Improper authorization validation on dashboards and charts import | < 3.0.4, >= 3.1.0, < 3.1.1 |
Version 3.0.3
| CVE | Title | Affected |
|---|
| CVE-2023-49657 | Stored XSS in Dashboard Title and Chart Title | < 3.0.3 |
Version 3.0.2, 2.1.3
| CVE | Title | Affected |
|---|
| CVE-2023-46104 | Allows for uncontrolled resource consumption via a ZIP bomb | < 2.1.3, >= 3.0.0, < 3.0.2 |
| CVE-2023-49736 | SQL Injection on where_in JINJA macro | < 2.1.3, >= 3.0.0, < 3.0.2 |
| CVE-2023-49734 | Privilege Escalation Vulnerability | < 2.1.3, >= 3.0.0, < 3.0.2 |
Version 3.0.0
| CVE | Title | Affected |
|---|
| CVE-2023-42502 | Open Redirect Vulnerability | < 3.0.0 |
| CVE-2023-42505 | Sensitive information disclosure on db connection details | < 3.0.0 |
Version 2.1.3
| CVE | Title | Affected |
|---|
| CVE-2023-42504 | Lack of rate limiting allows for possible denial of service | < 2.1.3 |
Version 2.1.2
| CVE | Title | Affected |
|---|
| CVE-2023-40610 | Privilege escalation with default examples database | < 2.1.2 |
| CVE-2023-42501 | Unnecessary read permissions within the Gamma role | < 2.1.2 |
| CVE-2023-43701 | Stored XSS on API endpoint | < 2.1.2 |
Version 2.1.1
| CVE | Title | Affected |
|---|
| CVE-2023-36387 | Improper API permission for low privilege users | < 2.1.1 |
| CVE-2023-36388 | Improper API permission for low privilege users allows for SSRF | < 2.1.1 |
| CVE-2023-27523 | Improper data permission validation on Jinja templated queries | < 2.1.1 |
| CVE-2023-27526 | Improper Authorization check on import charts | < 2.1.1 |
| CVE-2023-39264 | Stack traces enabled by default | < 2.1.1 |
| CVE-2023-39265 | Possible Unauthorized Registration of SQLite Database Connections | < 2.1.1 |
| CVE-2023-37941 | Metadata db write access can lead to remote code execution | < 2.1.1 |
| CVE-2023-32672 | SQL parser edge case bypasses data access authorization | < 2.1.1 |
Version 2.1.0
| CVE | Title | Affected |
|---|
| CVE-2023-25504 | Possible SSRF on import datasets | < 2.1.0 |
| CVE-2023-27524 | Session validation vulnerability when using provided default SECRET_KEY | < 2.1.0 |
| CVE-2023-27525 | Incorrect default permissions for Gamma role | < 2.1.0 |
| CVE-2023-30776 | Database connection password leak | < 2.1.0 |
Version 2.0.1
| CVE | Title | Affected |
|---|
| CVE-2022-41703 | SQL injection vulnerability in adhoc clauses | < 2.0.1 or < 1.5.2 |
| CVE-2022-43717 | Cross-Site Scripting on dashboards | < 2.0.1 or < 1.5.2 |
| CVE-2022-43718 | Cross-Site Scripting vulnerability on upload forms | < 2.0.1 or < 1.5.2 |
| CVE-2022-43719 | Cross Site Request Forgery (CSRF) on accept, request access | < 2.0.1 or < 1.5.2 |
| CVE-2022-43720 | Improper rendering of user input | < 2.0.1 or < 1.5.2 |
| CVE-2022-43721 | Open Redirect Vulnerability | < 2.0.1 or < 1.5.2 |
| CVE-2022-45438 | Dashboard metadata information leak | < 2.0.1 or < 1.5.2 |
