MEDIUM4.3

PYSEC-2026-1185

Apache Superset: Improper Neutralization of custom SQL on embedded context

Quick fix

PYSEC-2026-1185 — apache-superset: upgrade to the fixed version with the command below.

pip install --upgrade 'apache-superset>=3.0.4'

Details

A guest user could exploit a chart data REST API and send arbitrary SQL statements that on error could leak information from the underlying analytics database.This issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.

Users are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/apache-superset

Introduced in: 0Fixed in: 3.0.4

Fixpip install --upgrade 'apache-superset>=3.0.4'

References

https://nvd.nist.gov/vuln/detail/CVE-2024-24772[ADVISORY]
https://github.com/apache/superset[PACKAGE]
https://lists.apache.org/thread/gfl3ckwy6y9tpz9jmpv62orh2q346sn5[WEB]
http://www.openwall.com/lists/oss-security/2024/02/28/5[WEB]
https://pypi.org/project/apache-superset[PACKAGE]
https://github.com/advisories/GHSA-m6jm-3v38-76j4[ADVISORY]