Advisoriesby IbisApache SupersetGHSA-92qf-8gh3-gwcm
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions
Fix: upgrade to 4.1.0 or later
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset. Specifically, certain engine-specific functions are not checked, which allows attackers to bypass Apache Superset's SQL authorization. This issue is a follow-up to CVE-2024-39887 with additional disallowed PostgreSQL functions now included: query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema.
This issue affects Apache Superset: <4.1.0.
Users are recommended to upgrade to version 4.1.0, which fixes the issue or add these Postgres functions to the config set DISALLOWED_SQL_FUNCTIONS.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| apache-superset PyPI | < 4.1.0 | 4.1.0 |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-89
- Also known as
- BIT-superset-2024-53947, CVE-2024-53947, PYSEC-2026-1165
More Apache Superset advisories
All Apache Superset
Apache Superset Allows Ownership TakeoverCVE-2025-27696fixed in 4.1.2Apache Superset: SQLLab Improper readonly query validation allows unauthorized write accessCVE-2024-55633fixed in 4.1.0Apache Superset: Error verbosity exposes metadata in analytics databasesCVE-2024-53948fixed in 4.1.0Apache Superset: Lower privilege users are able to create Role when FAB_ADD_SECURITY_API is enabledCVE-2024-53949fixed in 4.1.0Apache Superset vulnerable to improper SQL authorizationCVE-2024-39887fixed in 4.0.2Apache Superset server arbitrary file readCVE-2024-34693fixed in 3.1.3 +1