Apache SupersetGHSA-92qf-8gh3-gwcm
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Low9.8CVE-2024-53947 · Published Dec 9, 2024 · updated Jul 7, 2026
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema. This issue affects Apache Superset: <4.1.0. Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-superset PyPI | < 4.1.0 | 4.1.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-89
- Also known as
- BIT-superset-2024-53947, CVE-2024-53947, PYSEC-2026-1165
More Apache Superset advisories
All Apache Superset| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| May 132025 | Apache Superset Allows Ownership Takeover Medium8.8May 13, 2025 | Medium8.8 | 4.1.2 |
| Dec 122024 | Apache Superset: SQLLab Improper readonly query validation allows unauthorized write accessHigh6.5Dec 12, 2024 | High6.5 | 4.1.0 |
| Dec 92024 | Apache Superset: Error verbosity exposes metadata in analytics databasesMedium5.3Dec 9, 2024 | Medium5.3 | 4.1.0 |
| Dec 92024 | Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabledHigh6.5Dec 9, 2024 | High6.5 | 4.1.0 |
| Jul 162024 | Apache Superset vulnerable to improper SQL authorizationMedium4.3Jul 16, 2024 | Medium4.3 | 4.0.2 |
| Jun 202024 | Apache Superset server arbitrary file readMedium6.8Jun 20, 2024 | Medium6.8 | 3.1.3+1 more |