Skip to content
Log inStart free trial

GHSA-5cx2-vq3h-x52c BIT-superset-2023-27524 CVE-2023-27524 PYSEC-2026-1161

Apache superset missing check for default SECRET_KEY

Critical Known exploited PyPI
Severity
8.9 / 10
Critical · CVSS 3.1
Exploit chance (EPSS)
98.15%
Chance of exploitation in the next 30 days. Higher than 99.91% of scored vulnerabilities.
Known exploited
Yes
In CISA's catalog since Jan 8, 2024
Weakness
CWE-1188 Initialization of a Resource with an Insecure Default
Fix
2.1.0
Upgrade apache-superset to this version or later
Exploited in the wild. Apache Superset Insecure Default Initialization of Resource Vulnerability (Apache Superset). Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by Jan 29, 2024.

Description

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.

Affected versions

PyPI

PackageVulnerableFixed in
apache-superset
< 2.1.0
2.1.0
apache-superset
< 2.1.0
2.1.0

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

apache-superset PyPI → 2.1.0

pip
pip install --upgrade "apache-superset>=2.1.0"
poetry
poetry add "apache-superset>=2.1.0"
uv
uv add "apache-superset>=2.1.0"

Severity breakdown

CVSS 3.1 8.9

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L/E:H

Attack vector
Network
Attack complexity
High
Privileges required
None
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
Low
Exploit maturity
H

Weakness

CWE-1188: Initialization of a Resource with an Insecure Default

The product initializes or sets a resource with a default that is intended to be changed by the product's installer, administrator, or maintainer, but the default is not secure.

References

Advisories

Fixes and patches

Packages

Other links

Timeline

  1. Published
  2. Added to CISA's Known Exploited Vulnerabilities catalog
  3. Remediation due for U.S. federal agencies
  4. Last updated by the source
  5. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-mwf2-qr4v-94h2
Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections
Medium Also affects apache-superset
GHSA-h294-8fxm-m2pj
Apache Superset allows authenticated users to view sensitive data without explicit permissions
Medium Also affects apache-superset
GHSA-3m2g-v7jf-7fxc
Apache Superset Improper Authorization allows low-privileged users to bypass access controls
Medium Also affects apache-superset
GHSA-gvxg-9hqx-f4rg
Apache Superset allows privileged users to conduct error-based SQL Injection
Medium Also affects apache-superset
GHSA-48m2-v2r8-h23m
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Medium Also affects apache-superset
GHSA-mhpq-m962-mg92
Apache Superset allows authenticated users to discover metadata about datasources they don't have permission to access
Medium Also affects apache-superset
GHSA-fxgf-3xh6-m2pp
Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions
Medium Also affects apache-superset
GHSA-9g5x-mm39-wg9r
Apache Superset data query improperly discloses database schema information to low-privileged guest user
Medium Also affects apache-superset
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor