MEDIUM6.5
PYSEC-2026-1167
Apache Superset uncontrolled resource consumption
Quick fix
PYSEC-2026-1167 — apache-superset: upgrade to the fixed version with the command below.
pip install --upgrade 'apache-superset>=2.1.2'Details
Uncontrolled resource consumption can be triggered by authenticated attacker that uploads a malicious ZIP to import database, dashboards or datasets. This vulnerability exists in Apache Superset versions up to and including 2.1.2 and versions 3.0.0, 3.0.1.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/apache-superset
Introduced in:
0Fixed in: 2.1.2Fix
pip install --upgrade 'apache-superset>=2.1.2'References
- https://nvd.nist.gov/vuln/detail/CVE-2023-46104[ADVISORY]
- https://github.com/apache/superset/commit/7c23cb0b3fd224c320b35f05e74b572033569154[WEB]
- https://github.com/apache/superset/commit/f473d13d0d89de5990209ff81b17dfe2cee884d3[WEB]
- https://github.com/apache/superset[PACKAGE]
- https://lists.apache.org/thread/yxbxg4wryb7cb7wyybk11l5nqy0rsrvl[WEB]
- http://www.openwall.com/lists/oss-security/2023/12/19/1[WEB]
- http://www.openwall.com/lists/oss-security/2024/02/14/2[WEB]
- http://www.openwall.com/lists/oss-security/2024/02/14/3[WEB]
- https://pypi.org/project/apache-superset[PACKAGE]
- https://github.com/advisories/GHSA-95mg-jgfx-54v9[ADVISORY]