CVE-2026-23983

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23983
A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue or make sure TAGGING_SYSTEM is False (Apache Superset current default)

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/62mgbc5hc8026skp69kb6vqozj3pr5ww Mailing List Vendor Advisory
http://www.openwall.com/lists/oss-security/2026/02/24/7 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*
History

17 Jun 2026, 10:22

Type Values Removed Values Added
Summary
  • (es) Hay una vulnerabilidad de exposición de datos sensibles en Apache Superset, que permite a usuarios autenticados recuperar información sensible del usuario. El endpoint Tag (deshabilitado por defecto) permite a los usuarios recuperar una lista de objetos asociados con una etiqueta específica. Cuando estos objetos asociados incluyen Usuarios, la respuesta de la API serializa y devuelve incorrectamente campos sensibles, incluyendo hashes de contraseña (pbkdf2), direcciones de correo electrónico y estadísticas de inicio de sesión. Esta vulnerabilidad permite a usuarios autenticados con pocos privilegios (por ejemplo, rol Gamma) ver datos de autenticación sensibles. Este problema afecta a Apache Superset: antes de 6.0.0. Se recomienda a los usuarios actualizar a la versión 6.0.0, que corrige el problema, o asegurarse de que TAGGING_SYSTEM sea False (valor predeterminado actual de Apache Superset).

25 Feb 2026, 14:37

Type Values Removed Values Added
References () https://lists.apache.org/thread/62mgbc5hc8026skp69kb6vqozj3pr5ww - () https://lists.apache.org/thread/62mgbc5hc8026skp69kb6vqozj3pr5ww - Mailing List, Vendor Advisory
References () http://www.openwall.com/lists/oss-security/2026/02/24/7 - () http://www.openwall.com/lists/oss-security/2026/02/24/7 - Mailing List, Third Party Advisory
CPE cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
First Time Apache
Apache superset

24 Feb 2026, 19:21

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/02/24/7 -

24 Feb 2026, 14:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-24 14:16

Updated : 2026-06-17 10:22

NVD link : CVE-2026-23983

Mitre link : CVE-2026-23983

CVE.ORG link : CVE-2026-23983

JSON object : View

Products Affected

apache

  • superset
CWE
CWE-200

Exposure of Sensitive Information to an Unauthorized Actor