Massive security weaknesses identified in Apache Superset could allow attackers to bypass read-only restrictions and execute full-scale SQL injection attacks — potentially exposing or destroying sensitive enterprise data. Immediate patching strongly advised.

Apache Superset Security Advisory

Affected Product: Apache Superset
Vendor: Apache Software Foundation
Platform Type: Open-source Business Intelligence and Data Visualization Platform
Primary Risk Area: SQL Lab execution engine and API query handling

Apache Superset is widely deployed as a centralized analytics interface that connects directly to production databases. Because it operates as a bridge between end users and backend data systems, any weakness in query validation or permission enforcement can directly affect data confidentiality, integrity, and availability.

The following vulnerabilities affect SQL execution controls and input validation logic inside Superset.

---

CVE-2026-23984

SQL Lab Read-Only Enforcement Bypass

---

Overview

Field	Details
CVE ID	CVE-2026-23984
Vulnerability Type	Improper Access Control / Authorization Bypass
Affected Component	SQL Lab
Attack Vector	Authenticated
Privileges Required	Low
User Interaction	None
Scope	Changed
Estimated CVSS	8.4 (High)
Severity	High
Exploitability	Medium to High
Exploit Availability	Limited PoC techniques observed

---

Vulnerability Description

A flaw was identified in SQL Lab’s read-only enforcement mechanism. When databases were configured as read-only within Superset, query validation relied on insufficient SQL inspection logic. Under certain crafted conditions, write operations were permitted even though the interface indicated that only SELECT queries were allowed.

The protection mechanism did not reliably detect:

• Multi-statement execution
• Stored procedure invocation
• Encoded or obfuscated keywords
• Database-specific execution wrappers
• Nested procedural blocks

As a result, authenticated users with basic SQL Lab access were able to execute data-modifying statements.

The issue affected environments where Superset was treated as the primary permission boundary instead of enforcing strict controls at the database level.

---

Technical Root Cause

• Incomplete SQL parsing logic
• Reliance on keyword filtering instead of AST-based validation
• Inadequate detection of procedural execution blocks
• Failure to block semicolon-separated multi-statements
• Database-specific command execution not properly handled

---

Exploitation Scenario (Educational Purpose Only)

An authenticated analyst with read-only access could submit a crafted query such as:

SELECT 1; DROP TABLE financial_reports;

Or by embedding write logic inside procedural constructs:

DO $$
BEGIN
   DELETE FROM audit_logs;
END $$;

Or by invoking execution wrappers supported by certain databases:

CALL run_command('UPDATE users SET role=''admin'' WHERE id=5');

In these cases, the validation layer incorrectly allowed execution because only the initial SELECT statement was inspected.

If database-side roles were permissive, destructive actions were executed successfully.

---

Potential Impact

• Deletion of production datasets
• Unauthorized modification of financial or operational data
• Privilege escalation via data manipulation
• Audit log tampering
• Regulatory compliance violations
• Business disruption

If combined with weak database permissioning, full data loss was possible.

---

MITRE ATT&CK Mapping

Tactic	Technique	ID
Initial Access	Valid Accounts	T1078
Privilege Escalation	Exploitation for Privilege Escalation	T1068
Impact	Data Destruction	T1485
Impact	Data Manipulation	T1565

---

Detection

Log Sources

• Superset application logs (superset.log)
• Gunicorn logs
• Reverse proxy logs (Nginx/Apache)
• Backend database audit logs
• Cloud SQL audit logs (if applicable)

---

Indicators of Compromise

• Execution of DROP, DELETE, UPDATE, INSERT
• Multiple statements separated by semicolons
• Presence of procedural keywords (DO, CALL, EXEC)
• Query execution by users assigned read-only roles
• Unexpected table modification timestamps

---

Detection Queries

Splunk

index=superset_logs component=sql_lab
| search query="*DROP*" OR query="*DELETE*" OR query="*UPDATE*" OR query="*INSERT*"
| stats count by user, query

Elasticsearch / Kibana (KQL)

log.source:"sql_lab" AND
(query:*DROP* OR query:*DELETE* OR query:*UPDATE* OR query:*INSERT*)

PostgreSQL Audit Monitoring

SELECT *
FROM pg_stat_activity
WHERE query ~* '(DROP|DELETE|UPDATE|INSERT)'
AND usename IN (SELECT rolname FROM pg_roles WHERE rolname LIKE '%readonly%');

---

Prevention and Hardening

• Enforce read-only roles at database level
• Disable multi-statement execution
• Restrict SQL Lab access to trusted users
• Enable strict query logging
• Apply least privilege principle
• Use database firewalling

---

Official Patch

The vulnerability was addressed in the official Apache Superset security release.

Upgrade guidance and patched versions are available at:
https://superset.apache.org/docs/installation/upgrading-superset

---

---

CVE-2026-23980

SQL Injection (Error-Based)

---

Overview

Field	Details
CVE ID	CVE-2026-23980
Vulnerability Type	SQL Injection
Affected Component	API / Query Processing
Attack Vector	Remote
Privileges Required	Varies
User Interaction	None
Scope	Unchanged
Estimated CVSS	9.1 (Critical)
Severity	Critical
Exploitability	High
Exploit Availability	Public PoC patterns observed

---

Vulnerability Description

A SQL injection vulnerability was identified in Superset’s request parameter handling logic. User-controlled inputs were improperly concatenated into SQL statements without consistent parameter binding.

Error-based SQL injection was possible. By intentionally triggering database errors, attackers were able to extract:

• Database version information
• Table and column names
• Superset metadata database contents
• Stored credential information
• Administrative user data

The issue was particularly dangerous when Superset was publicly exposed.

---

Technical Root Cause

• Lack of consistent parameterized query enforcement
• Dynamic SQL construction
• Insufficient input sanitization
• Error messages returned with database details
• Absence of strict validation for API parameters

---

Exploitation Scenario (Educational)

An attacker could inject malicious input through parameters such as:

• Dataset ID
• Chart filters
• REST API fields
• URL query parameters

Example payload designed to trigger an error:

?id=1 AND updatexml(null,concat(0x7e,(SELECT user()),0x7e),null)

Or:

?id=1 UNION SELECT null, version(), null--

The database error response would reveal sensitive information.

If database permissions were overly broad, full data extraction was achievable.

---

Potential Impact

• Full metadata database compromise
• Extraction of admin password hashes
• Exposure of database connection strings
• Lateral movement to backend systems
• Complete BI platform takeover

In internet-exposed deployments, compromise could occur rapidly.

---

MITRE ATT&CK Mapping

Tactic	Technique	ID
Initial Access	Exploit Public-Facing Application	T1190
Credential Access	Credential Dumping	T1003
Discovery	Database Discovery	T1046
Collection	Data from Information Repositories	T1213

---

Detection

Log Sources

• Web server access logs
• Superset API logs
• WAF logs
• Database error logs
• Reverse proxy logs

---

Indicators of Injection

• UNION SELECT
• ' OR 1=1
• updatexml
• extractvalue
• information_schema
• @@version
• sleep( or benchmark(
• High frequency of 500 HTTP errors

---

Detection Queries

Splunk

index=web_logs
| search uri_query="*union select*" OR uri_query="*updatexml*" OR uri_query="*information_schema*"
| stats count by src_ip, uri_query

Elasticsearch / Kibana (KQL)

url.query : "*union select*" OR
url.query : "*updatexml*" OR
url.query : "*information_schema*"

Nginx Log Monitoring

grep -Ei "union select|updatexml|extractvalue|information_schema|@@version" access.log

---

Database Error Spike Monitoring

index=database_logs error_level=ERROR
| stats count by client_ip
| where count > 20

---

Prevention and Hardening

• Upgrade immediately
• Enforce parameterized queries
• Disable verbose database error responses
• Deploy Web Application Firewall
• Restrict public exposure
• Rotate database credentials
• Implement strict RBAC
• Enable database query auditing

---

Official Patch

The issue was resolved in the official Apache Superset security update.

Upgrade instructions are available at:
https://superset.apache.org/docs/installation/upgrading-superset

---

Executive Risk Summary

CVE-2026-23984 enabled privilege bypass within SQL Lab.
CVE-2026-23980 allowed direct SQL injection.

When combined, these issues could permit authenticated users to escalate privileges and exfiltrate or destroy backend data.

Immediate upgrade and database-level permission enforcement are strongly recommended.

---