CVE-2025-55673 Apache Superset: Metadata exposure in embedded charts

What is CVE-2025-55673?

CVE-2025-55673 is a medium-severity vulnerability in Apache Superset, published on 14 Aug 2025. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user.

This issue affects Apache Superset: before 4.1.3.

Users are recommended to upgrade to version 4.1.3, which fixes the issue.

Weakness: CWE-200

Which versions are affected by CVE-2025-55673?

4 open source packages ship an affected version, including apache-superset and superset. It affects 1 product.

Products include Apache Superset.

How do I fix CVE-2025-55673?

Upgrade apache-superset to 4.1.3.post1 or later.

Is CVE-2025-55673 being exploited?

There is no known exploitation of CVE-2025-55673 in the wild and no public exploit code.

Other vulnerabilities in Apache Superset

• CVE-2023-27524 Apache Superset Insecure Default Initialization of Resource Exploited High 8.9
• CVE-2022-27479 SQL injection vulnerability in chart data API Critical 9.8
• CVE-2018-8021 Deserialization of Untrusted Data in superset Critical 9.8
• CVE-2023-49657 Apache Superset: Stored XSS in Dashboard Title and Chart Title Critical 9.6
• CVE-2022-43719 Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API High 8.8

All Apache Superset vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-superset-2025-55673, GHSA-9g5x-mm39-wg9r, PYSEC-2026-1169.