MEDIUM4.3

PYSEC-2026-1153

Apache Superset Incorrect Authorization vulnerability

Quick fix

PYSEC-2026-1153 — apache-superset: upgrade to the fixed version with the command below.

pip install --upgrade 'apache-superset>=3.1.2'

Details

An authenticated user could potentially access metadata for a datasource they are not authorized to view by submitting a targeted REST API request. This issue affects Apache Superset before 3.1.2.

Users are recommended to upgrade to version 3.1.2 or above, which fixes the issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/apache-superset

Introduced in: 0Fixed in: 3.1.2

Fixpip install --upgrade 'apache-superset>=3.1.2'

References

https://nvd.nist.gov/vuln/detail/CVE-2024-28148[ADVISORY]
https://github.com/apache/superset[PACKAGE]
https://lists.apache.org/thread/n27wlbd05oc6bgjh28d5pxzsrrph8dgo[WEB]
https://pypi.org/project/apache-superset[PACKAGE]
https://github.com/advisories/GHSA-299q-3p96-5898[ADVISORY]