Apache Superset vulnerabilities
70 published vulnerabilities in Apache Superset, 1 of them exploited in the wild. The most were published in 2023 (22), and 7 so far in 2026.
Apache Superset vulnerabilities by year
2018
2019
2020
2021
2022
2023
2024
2025
2026
Most exploited Apache Superset vulnerabilities
- CVE-2023-27524 Apache Superset Insecure Default Initialization of Resource
- CVE-2022-27479 SQL injection vulnerability in chart data API
- CVE-2018-8021 Deserialization of Untrusted Data in superset
- CVE-2023-49657 Apache Superset: Stored XSS in Dashboard Title and Chart Title
- CVE-2022-43719 Apache Superset: Cross Site Request Forgery (CSRF) on accept, request access API
- CVE-2021-41971 Possible SQL Injection when template processing is enabled
- CVE-2020-13948 Apache Superset OS Command Injection
- CVE-2020-13952 Plaintext password leak in Apache Superset
- CVE-2023-49734 Apache Superset: Privilege Escalation Vulnerability
- CVE-2024-53949 Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabled
- CVE-2026-23982 Apache Superset: Improper Authorization in Dataset Creation Allows Access Control Bypass
- CVE-2026-23984 Apache Superset: SQLLab Read-Only Bypass on PostgreSQL
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.