MEDIUM4.3

PYSEC-2026-1172

Apache Superset may expose internal traces on REST API endpoints

Quick fix

PYSEC-2026-1172 — apache-superset: upgrade to the fixed version with the command below.

pip install --upgrade 'apache-superset>=2.1.1'

Details

By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/apache-superset

Introduced in: 0Fixed in: 2.1.1

Fixpip install --upgrade 'apache-superset>=2.1.1'

References

https://nvd.nist.gov/vuln/detail/CVE-2023-39264[ADVISORY]
https://github.com/apache/superset[PACKAGE]
https://lists.apache.org/thread/y65t1of7hb445n86o1vdzjct7rfwlx75[WEB]
https://pypi.org/project/apache-superset[PACKAGE]
https://github.com/advisories/GHSA-cpvx-2365-466c[ADVISORY]