AI and data stack advisories

Severe, 6 weeks1498Projects326

1498 severe, 6 weeks · 326 projects

Apache SupersetGHSA-cpvx-2365-466c

Apache Superset may expose internal traces on REST API endpoints

Apache Superset

CVE-2023-39264 · Published Sep 6, 2023 · updated Jul 7, 2026

Medium4.3
No fix yet
GitHub advisory

By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
<= 2.1.0No fix yet
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-209
Also known as
BIT-superset-2023-39264, CVE-2023-39264, PYSEC-2026-1172

More Apache Superset advisories

All Apache Superset
Medium 4.3Sep 6, 2023Apache Superset has incorrect authorization checkCVE-2023-32672no fix yetMedium 6.6Sep 6, 2023Apache Superset Deserialization of Untrusted Data vulnerabilityCVE-2023-37941fixed in 2.1.1Medium 6.5Sep 6, 2023Apache Superset Improper Input Validation vulnerabilityCVE-2023-39265no fix yetMedium 4.3Sep 6, 2023Apache Superset Server Side Request Forgery vulnerabilityCVE-2023-36388no fix yetMedium 5.4Sep 6, 2023Apache Superset has improper default REST API permission for Gamma usersCVE-2023-36387no fix yetMedium 4.3Sep 6, 2023Apache Superset users may incorrectly create resources using the import charts featureCVE-2023-27526no fix yet