AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-4fg9-5w46-xmrj

Apache Superset Server Side Request Forgery vulnerability

Apache Superset

CVE-2023-36388 · Published Sep 6, 2023 · updated Jul 7, 2026

Medium4.3
No fix yet
GitHub advisory

Improper REST API permission in Apache Superset up to and including 2.1.0 allows for an authenticated Gamma users to test network connections, possible SSRF.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
<= 2.1.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-918
Also known as
BIT-superset-2023-36388, CVE-2023-36388, PYSEC-2026-1159

More Apache Superset advisories

All Apache Superset
Medium 4.3Sep 6, 2023Apache Superset has incorrect authorization checkCVE-2023-32672no fix yetMedium 6.6Sep 6, 2023Apache Superset Deserialization of Untrusted Data vulnerabilityCVE-2023-37941fixed in 2.1.1Medium 6.5Sep 6, 2023Apache Superset Improper Input Validation vulnerabilityCVE-2023-39265no fix yetMedium 5.4Sep 6, 2023Apache Superset has improper default REST API permission for Gamma usersCVE-2023-36387no fix yetMedium 4.3Sep 6, 2023Apache Superset users may incorrectly create resources using the import charts featureCVE-2023-27526no fix yetMedium 4.3Sep 6, 2023Apache Superset may expose internal traces on REST API endpointsCVE-2023-39264no fix yet