MEDIUM5.0

PYSEC-2026-1187

Apache Superset vulnerable to improper data authorization

Quick fix

PYSEC-2026-1187 — apache-superset: upgrade to the fixed version with the command below.

pip install --upgrade 'apache-superset>=2.1.1'

Details

Improper data authorization check on Jinja templated queries in Apache Superset up to and including 2.1.0 allows for an authenticated user to issue queries on database tables they may not have access to.

Are you affected?

Enter the version of the package you're using.

Affected packages

PyPI/apache-superset

Introduced in: 0Fixed in: 2.1.1

Fixpip install --upgrade 'apache-superset>=2.1.1'

References

https://nvd.nist.gov/vuln/detail/CVE-2023-27523[ADVISORY]
https://github.com/apache/superset[PACKAGE]
https://lists.apache.org/thread/3y97nmwm956b6zg3l8dh9oj0w7dj945h[WEB]
https://pypi.org/project/apache-superset[PACKAGE]
https://github.com/advisories/GHSA-v594-2c97-hx38[ADVISORY]