AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-2cx9-54hp-r698

Apache Superset: Error verbosity exposes metadata in analytics databases

Apache Superset

CVE-2024-53948 · Published Dec 9, 2024 · updated Jul 7, 2026

Medium5.3
Fix: upgrade to 4.1.0 or later
GitHub advisory

Generation of Error Message Containing analytics metadata Information in Apache Superset.

This issue affects Apache Superset: before 4.1.0.

Users are recommended to upgrade to version 4.1.0, which fixes the issue.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
< 4.1.04.1.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-209
Also known as
BIT-superset-2024-53948, CVE-2024-53948, PYSEC-2026-1154

More Apache Superset advisories

All Apache Superset
Medium 8.8May 13, 2025Apache Superset Allows Ownership TakeoverCVE-2025-27696fixed in 4.1.2High 6.5Dec 12, 2024Apache Superset: SQLLab Improper readonly query validation allows unauthorized write accessCVE-2024-55633fixed in 4.1.0High 6.5Dec 9, 2024Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabledCVE-2024-53949fixed in 4.1.0Low 9.8Dec 9, 2024Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functionsCVE-2024-53947fixed in 4.1.0Medium 4.3Jul 16, 2024Apache Superset vulnerable to improper SQL authorizationCVE-2024-39887fixed in 4.0.2Medium 6.8Jun 20, 2024Apache Superset server arbitrary file readCVE-2024-34693fixed in 3.1.3 +1