AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

Apache SupersetGHSA-h7r6-8qmm-hj5r

Apache Superset: Improper error handling on alerts

Apache Superset

CVE-2024-27315 · Published Feb 28, 2024 · updated Jul 7, 2026

Medium4.3
Fix: upgrade to 3.0.4 or later (2 fixed versions below)
GitHub advisory

An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data.

This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.

Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

Affected versions

PackageAffectedFixed in
apache-superset
PyPI
< 3.0.43.0.4
>= 3.1.0, < 3.1.13.1.1
Details and references
CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Severity from
GitHub (reviewed advisory)
Weakness
CWE-200, CWE-209
Also known as
BIT-superset-2024-27315, CVE-2024-27315, PYSEC-2026-1181

More Apache Superset advisories

All Apache Superset
Medium 4.3May 7, 2024Apache Superset Incorrect Authorization vulnerabilityCVE-2024-28148fixed in 3.1.2Medium 4.3Feb 28, 2024Apache Superset: Improper authorization validation on dashboards and charts importCVE-2024-26016fixed in 3.0.4 +1Medium 5.0Feb 28, 2024Apache Superset: Improper data authorization when creating a new datasetCVE-2024-24779fixed in 3.0.4 +1Medium 4.9Feb 28, 2024Apache Superset: Improper validation of SQL statements allows for unauthorized access to dataCVE-2024-24773fixed in 3.0.4 +1Medium 4.3Feb 28, 2024Apache Superset: Improper Neutralization of custom SQL on embedded contextCVE-2024-24772fixed in 3.0.4 +1Critical 9.6Jan 23, 2024Cross-site Scripting in Apache supersetCVE-2023-49657fixed in 3.0.3