CVE-2026-23984

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23984
An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://lists.apache.org/thread/72cmgxtvp9pclto4ln1chbs1227nwd26 Mailing List
http://www.openwall.com/lists/oss-security/2026/02/24/8 Mailing List Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*
History

17 Jun 2026, 10:22

Type Values Removed Values Added
Summary
  • (es) Existe una vulnerabilidad de validación de entrada incorrecta en Apache Superset que permite a un usuario autenticado con acceso a SQLLab eludir la verificación de solo lectura al usar una conexión de base de datos PostgreSQL. Si bien el sistema bloquea eficazmente las sentencias estándar del Lenguaje de Manipulación de Datos (DML) (p. ej., INSERT, UPDATE, DELETE) en conexiones de solo lectura, no logra detectarlas en sentencias SQL especialmente diseñadas. Este problema afecta a Apache Superset: antes de 6.0.0. Se recomienda a los usuarios actualizar a la versión 6.0.0, que corrige el problema.

26 Feb 2026, 16:25

Type Values Removed Values Added
First Time Apache
Apache superset
References () https://lists.apache.org/thread/72cmgxtvp9pclto4ln1chbs1227nwd26 - () https://lists.apache.org/thread/72cmgxtvp9pclto4ln1chbs1227nwd26 - Mailing List
References () http://www.openwall.com/lists/oss-security/2026/02/24/8 - () http://www.openwall.com/lists/oss-security/2026/02/24/8 - Mailing List, Third Party Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 6.5
CPE cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*

24 Feb 2026, 19:21

Type Values Removed Values Added
References
  • () http://www.openwall.com/lists/oss-security/2026/02/24/8 -

24 Feb 2026, 14:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-02-24 14:16

Updated : 2026-06-17 10:22

NVD link : CVE-2026-23984

Mitre link : CVE-2026-23984

CVE.ORG link : CVE-2026-23984

JSON object : View

Products Affected

apache

  • superset
CWE
CWE-863

Incorrect Authorization