Skip to content

Commit 34c98b4

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-3m2g-v7jf-7fxc GHSA-48m2-v2r8-h23m GHSA-gvxg-9hqx-f4rg GHSA-h294-8fxm-m2pj GHSA-mwf2-qr4v-94h2
1 parent 3714b99 commit 34c98b4

5 files changed

Lines changed: 151 additions & 37 deletions

File tree

advisories/unreviewed/2026/02/GHSA-3m2g-v7jf-7fxc/GHSA-3m2g-v7jf-7fxc.json renamed to advisories/github-reviewed/2026/02/GHSA-3m2g-v7jf-7fxc/GHSA-3m2g-v7jf-7fxc.json

Lines changed: 30 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,49 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-3m2g-v7jf-7fxc",
4-
"modified": "2026-02-25T15:31:37Z",
4+
"modified": "2026-02-26T15:28:38Z",
55
"published": "2026-02-24T15:30:30Z",
66
"aliases": [
77
"CVE-2026-23982"
88
],
9+
"summary": "Apache Superset Improper Authorization allows low-privileged users to bypass access controls ",
910
"details": "An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset.\n\nThis issue affects Apache Superset: before 6.0.0.\n\nUsers are recommended to upgrade to version 6.0.0, which fixes the issue.",
1011
"severity": [
11-
{
12-
"type": "CVSS_V3",
13-
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14-
},
1512
{
1613
"type": "CVSS_V4",
17-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "apache-superset"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "6.0.0"
32+
}
33+
]
34+
}
35+
]
1836
}
1937
],
20-
"affected": [],
2138
"references": [
2239
{
2340
"type": "ADVISORY",
2441
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23982"
2542
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/apache/superset"
46+
},
2647
{
2748
"type": "WEB",
2849
"url": "https://lists.apache.org/thread/9lvbzwkw4rxgdvbpfvnnnfcll92v75fp"
@@ -37,8 +58,8 @@
3758
"CWE-863"
3859
],
3960
"severity": "HIGH",
40-
"github_reviewed": false,
41-
"github_reviewed_at": null,
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-02-26T15:28:38Z",
4263
"nvd_published_at": "2026-02-24T14:16:22Z"
4364
}
4465
}

advisories/unreviewed/2026/02/GHSA-48m2-v2r8-h23m/GHSA-48m2-v2r8-h23m.json renamed to advisories/github-reviewed/2026/02/GHSA-48m2-v2r8-h23m/GHSA-48m2-v2r8-h23m.json

Lines changed: 30 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,49 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-48m2-v2r8-h23m",
4-
"modified": "2026-02-24T21:31:45Z",
4+
"modified": "2026-02-26T15:28:10Z",
55
"published": "2026-02-24T15:30:30Z",
66
"aliases": [
77
"CVE-2026-23969"
88
],
9+
"summary": "Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine",
910
"details": "Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete.\n\nThis issue affects Apache Superset: before 4.1.2.\n\nUsers are recommended to upgrade to version 4.1.2, which fixes the issue.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V4",
13-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "apache-superset"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "4.1.2"
32+
}
33+
]
34+
}
35+
]
1436
}
1537
],
16-
"affected": [],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23969"
2142
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/apache/superset"
46+
},
2247
{
2348
"type": "WEB",
2449
"url": "https://lists.apache.org/thread/2q22sp4oj3krcgdkxchhtht0vgwp2wnd"
@@ -33,8 +58,8 @@
3358
"CWE-89"
3459
],
3560
"severity": "MODERATE",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-02-26T15:28:10Z",
3863
"nvd_published_at": "2026-02-24T14:16:22Z"
3964
}
4065
}

advisories/unreviewed/2026/02/GHSA-gvxg-9hqx-f4rg/GHSA-gvxg-9hqx-f4rg.json renamed to advisories/github-reviewed/2026/02/GHSA-gvxg-9hqx-f4rg/GHSA-gvxg-9hqx-f4rg.json

Lines changed: 30 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,49 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-gvxg-9hqx-f4rg",
4-
"modified": "2026-02-25T15:31:37Z",
4+
"modified": "2026-02-26T15:28:27Z",
55
"published": "2026-02-24T15:30:30Z",
66
"aliases": [
77
"CVE-2026-23980"
88
],
9+
"summary": "Apache Superset allows privileged users to conduct error-based SQL Injection",
910
"details": "Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters.\n\nThis issue affects Apache Superset: before 6.0.0.\n\nUsers are recommended to upgrade to version 6.0.0, which fixes the issue.",
1011
"severity": [
11-
{
12-
"type": "CVSS_V3",
13-
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14-
},
1512
{
1613
"type": "CVSS_V4",
17-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "apache-superset"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "6.0.0"
32+
}
33+
]
34+
}
35+
]
1836
}
1937
],
20-
"affected": [],
2138
"references": [
2239
{
2340
"type": "ADVISORY",
2441
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23980"
2542
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/apache/superset"
46+
},
2647
{
2748
"type": "WEB",
2849
"url": "https://lists.apache.org/thread/h4l02zw1pr2vywv0dc5zjn3grdcdhwf4"
@@ -37,8 +58,8 @@
3758
"CWE-89"
3859
],
3960
"severity": "MODERATE",
40-
"github_reviewed": false,
41-
"github_reviewed_at": null,
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-02-26T15:28:27Z",
4263
"nvd_published_at": "2026-02-24T14:16:22Z"
4364
}
4465
}

advisories/unreviewed/2026/02/GHSA-h294-8fxm-m2pj/GHSA-h294-8fxm-m2pj.json renamed to advisories/github-reviewed/2026/02/GHSA-h294-8fxm-m2pj/GHSA-h294-8fxm-m2pj.json

Lines changed: 30 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,49 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-h294-8fxm-m2pj",
4-
"modified": "2026-02-25T15:31:37Z",
4+
"modified": "2026-02-26T15:28:47Z",
55
"published": "2026-02-24T15:30:30Z",
66
"aliases": [
77
"CVE-2026-23983"
88
],
9+
"summary": "Apache Superset allows authenticated users to view sensitive data without explicit permissions",
910
"details": "A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag.\nWhen these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data \n\nThis issue affects Apache Superset: before 6.0.0.\n\nUsers are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default)",
1011
"severity": [
11-
{
12-
"type": "CVSS_V3",
13-
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
14-
},
1512
{
1613
"type": "CVSS_V4",
17-
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "apache-superset"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "6.0.0"
32+
}
33+
]
34+
}
35+
]
1836
}
1937
],
20-
"affected": [],
2138
"references": [
2239
{
2340
"type": "ADVISORY",
2441
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23983"
2542
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/apache/superset"
46+
},
2647
{
2748
"type": "WEB",
2849
"url": "https://lists.apache.org/thread/62mgbc5hc8026skp69kb6vqozj3pr5ww"
@@ -37,8 +58,8 @@
3758
"CWE-200"
3859
],
3960
"severity": "LOW",
40-
"github_reviewed": false,
41-
"github_reviewed_at": null,
61+
"github_reviewed": true,
62+
"github_reviewed_at": "2026-02-26T15:28:47Z",
4263
"nvd_published_at": "2026-02-24T14:16:23Z"
4364
}
4465
}

advisories/unreviewed/2026/02/GHSA-mwf2-qr4v-94h2/GHSA-mwf2-qr4v-94h2.json renamed to advisories/github-reviewed/2026/02/GHSA-mwf2-qr4v-94h2/GHSA-mwf2-qr4v-94h2.json

Lines changed: 31 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,49 @@
11
{
22
"schema_version": "1.4.0",
33
"id": "GHSA-mwf2-qr4v-94h2",
4-
"modified": "2026-02-24T21:31:45Z",
4+
"modified": "2026-02-26T15:29:01Z",
55
"published": "2026-02-24T15:30:30Z",
66
"aliases": [
77
"CVE-2026-23984"
88
],
9+
"summary": "Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections",
910
"details": "An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection.\nWhile the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements.\n\nThis issue affects Apache Superset: before 6.0.0.\n\nUsers are recommended to upgrade to version 6.0.0, which fixes the issue.",
1011
"severity": [
1112
{
1213
"type": "CVSS_V4",
13-
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X"
14+
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "PyPI",
21+
"name": "apache-superset"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"fixed": "6.0.0"
32+
}
33+
]
34+
}
35+
]
1436
}
1537
],
16-
"affected": [],
1738
"references": [
1839
{
1940
"type": "ADVISORY",
2041
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23984"
2142
},
43+
{
44+
"type": "PACKAGE",
45+
"url": "https://github.com/apache/superset"
46+
},
2247
{
2348
"type": "WEB",
2449
"url": "https://lists.apache.org/thread/72cmgxtvp9pclto4ln1chbs1227nwd26"
@@ -30,11 +55,12 @@
3055
],
3156
"database_specific": {
3257
"cwe_ids": [
58+
"CWE-200",
3359
"CWE-863"
3460
],
3561
"severity": "HIGH",
36-
"github_reviewed": false,
37-
"github_reviewed_at": null,
62+
"github_reviewed": true,
63+
"github_reviewed_at": "2026-02-26T15:29:00Z",
3864
"nvd_published_at": "2026-02-24T14:16:23Z"
3965
}
4066
}

0 commit comments

Comments
 (0)