AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

Apache SupersetGHSA-cmjc-52fg-9f7j

Apache Superset vulnerable to Exposure of Sensitive Information

Apache Superset

CVE-2023-30776 · Published Jul 6, 2023 · updated Jul 7, 2026

Medium6.5
Fix: upgrade to 2.1.0 or later
GitHub advisory

An authenticated user with specific data permissions could access database connections stored passwords by requesting a specific REST API. This issue affects Apache Superset version 1.3.0 up to 2.0.1.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
>= 1.3.0, < 2.1.02.1.0
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-200
Also known as
BIT-superset-2023-30776, CVE-2023-30776, PYSEC-2026-1171

More Apache Superset advisories

All Apache Superset
Medium 5.0Sep 6, 2023Apache Superset vulnerable to improper data authorizationCVE-2023-27523no fix yetMedium 4.3Sep 6, 2023Apache Superset may expose internal traces on REST API endpointsCVE-2023-39264no fix yetMedium 4.3Sep 6, 2023Apache Superset users may incorrectly create resources using the import charts featureCVE-2023-27526no fix yetMedium 5.4Sep 6, 2023Apache Superset has improper default REST API permission for Gamma usersCVE-2023-36387no fix yetMedium 4.3Sep 6, 2023Apache Superset Server Side Request Forgery vulnerabilityCVE-2023-36388no fix yetMedium 6.5Jul 6, 2023Apache Superset Server-Side Request Forgery vulnerabilityCVE-2023-25504fixed in 2.1.0