AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-787v-v9vq-4rgv

Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

Apache Superset

CVE-2024-55633 · Published Dec 12, 2024 · updated Jul 7, 2026

High6.5
Fix: upgrade to 4.1.0 or later
GitHub advisory

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgres analytics database connections set with a readonly user (advised) are not vulnerable. 

This issue affects Apache Superset: before 4.1.0.

Users are recommended to upgrade to version 4.1.0, which fixes the issue.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
< 4.1.04.1.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-285, CWE-863
Also known as
BIT-superset-2024-55633, CVE-2024-55633, PYSEC-2026-1162

More Apache Superset advisories

All Apache Superset
HighMay 30, 2025Apache Superset: Improper authorization bypass on row level security via SQL InjectionCVE-2025-48912fixed in 4.1.2Medium 8.8May 13, 2025Apache Superset Allows Ownership TakeoverCVE-2025-27696fixed in 4.1.2Medium 5.3Dec 9, 2024Apache Superset: Error verbosity exposes metadata in analytics databasesCVE-2024-53948fixed in 4.1.0High 6.5Dec 9, 2024Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabledCVE-2024-53949fixed in 4.1.0Low 9.8Dec 9, 2024Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functionsCVE-2024-53947fixed in 4.1.0Medium 4.3Jul 16, 2024Apache Superset vulnerable to improper SQL authorizationCVE-2024-39887fixed in 4.0.2