CVE-2026-23980: 
Apache Superset vulnerability analysis and mitigation

CVE-2026-23980 is a SQL injection vulnerability in Apache Superset that allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. It affects all versions of Apache Superset before 6.0.0 and was publicly disclosed on February 24, 2026, via the Apache security mailing list. The vulnerability is classified as CWE-89 (Improper Neutralization of Special Elements used in an SQL Command). It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (Apache OSS-Sec, Red Hat Advisory).

The root cause is improper neutralization of user-supplied input passed to SQL query parameters, specifically sqlExpression and where, which are used in dataset or chart query construction within Apache Superset (CWE-89). An attacker can craft malicious SQL fragments in these parameters to trigger database error messages that leak schema or data information — a technique known as error-based SQL injection. Exploitation requires only a valid authenticated session with read-level access; no elevated privileges or user interaction are needed. The vulnerability is network-exploitable with low attack complexity (Apache OSS-Sec, Apache Mailing List).

Successful exploitation allows an authenticated attacker to extract sensitive data from the backend database through error messages, resulting in unauthorized disclosure of confidential information. The impact is limited to confidentiality — integrity and availability are not affected, as the attack vector does not support data modification or deletion. Depending on the data stored in the Superset-connected database, this could expose business-critical datasets, credentials, or other sensitive records (Red Hat Advisory, Apache OSS-Sec).

1. Reconnaissance: Identify Apache Superset instances running versions prior to 6.0.0 using network scanning tools or by checking the Superset version endpoint (e.g., /api/v1/ or the UI footer).
2. Authentication: Obtain valid credentials for any user account with at least read access to a dataset or chart in the target Superset instance.
3. Identify injectable parameters: Navigate to a dataset or chart query interface and locate API endpoints that accept sqlExpression or where parameters (e.g., /api/v1/chart/data or similar dataset query endpoints).
4. Craft error-based SQL injection payload: Inject a malicious SQL fragment into the sqlExpression or where parameter designed to trigger a database error that reveals schema or data information (e.g., ' AND 1=CONVERT(int, (SELECT TOP 1 table_name FROM information_schema.tables))--).
5. Extract data via error messages: Analyze the error responses returned by the application to enumerate database tables, columns, and sensitive data values iteratively.
6. Exfiltrate target data: Repeat the injection with refined payloads to extract specific sensitive records from the backend database (Apache OSS-Sec).

• Network: Unusual or repeated API requests to Superset chart/dataset query endpoints (e.g., /api/v1/chart/data) containing SQL metacharacters (', --, CONVERT, CAST, UNION) in sqlExpression or where parameters.
• Logs: Superset application logs showing database error messages in API responses, particularly errors referencing SQL syntax or type conversion failures triggered by user-supplied input; repeated 400/500 HTTP responses from query endpoints for the same authenticated user.
• Database Logs: Unusual SQL queries originating from the Superset service account containing error-inducing constructs such as CONVERT(int, ...), EXTRACTVALUE(...), or UPDATEXML(...) patterns typical of error-based injection.
• Behavioral: A single authenticated user account generating a high volume of failed or error-producing queries against dataset endpoints in a short time window.

The primary remediation is to upgrade Apache Superset to version 6.0.0 or later, which contains the fix for this vulnerability (Apache OSS-Sec, Apache Mailing List). As interim mitigations, administrators should restrict read access permissions to only trusted and necessary users, implement Web Application Firewall (WAF) rules to detect and block SQL injection patterns in API parameters, and monitor database access logs for anomalous query patterns. Implementing parameterized queries and input validation at the application layer is also recommended as a defense-in-depth measure.

The vulnerability was reported by Pritam Chakkerwar (finder) and Dhanush Nayak (reporter), with the fix developed by Pedro Sousa, as credited in the official Apache disclosure (Apache OSS-Sec). Security Online Info covered the disclosure as part of a broader report on five vulnerabilities patched in Apache Superset simultaneously (Security Online). Community discussion was noted on Bluesky and various vulnerability aggregator platforms shortly after disclosure, though no major threat actor attribution or widespread alarm was reported.