CVE-2026-23980

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23980
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/h4l02zw1pr2vywv0dc5zjn3grdcdhwf4 Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/02/24/5 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*
History

17 Jun 2026, 10:22

Type Values Removed Values Added
Summary
  • (es) Vulnerabilidad de Neutralización Incorrecta de Elementos Especiales utilizados en un Comando SQL ('Inyección SQL') en Apache Superset permite a un usuario autenticado con acceso de lectura realizar una inyección SQL basada en errores a través de los parámetros sqlExpression o where. Este problema afecta a Apache Superset: versiones anteriores a la 6.0.0. Se recomienda a los usuarios actualizar a la versión 6.0.0, que corrige el problema.

25 Feb 2026, 14:36

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
CPE cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*
References () https://lists.apache.org/thread/h4l02zw1pr2vywv0dc5zjn3grdcdhwf4 - () https://lists.apache.org/thread/h4l02zw1pr2vywv0dc5zjn3grdcdhwf4 - Mailing List, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2026/02/24/5 - () http://www.openwall.com/lists/oss-security/2026/02/24/5 - Mailing List, Third Party Advisory
First Time Apache
Apache superset

24 Feb 2026, 19:21

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/02/24/5 -

24 Feb 2026, 14:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-24 14:16

Updated : 2026-06-17 10:22

NVD link : CVE-2026-23980

Mitre link : CVE-2026-23980

CVE.ORG link : CVE-2026-23980

JSON object : View

Products Affected

apache

  • superset
CWE
CWE-89

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')