CVE-2026-23982: 
Apache Superset vulnerability analysis and mitigation

CVE-2026-23982 is an Improper Authorization vulnerability in Apache Superset that allows a low-privileged authenticated user to bypass data access controls. Reported by River Koh and remediated by Daniel Gaspar, it was publicly disclosed on February 24, 2026. All Apache Superset versions before 6.0.0 are affected. It carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (Apache OSS-Security, Red Hat).

The vulnerability is classified as CWE-863 (Incorrect Authorization). When creating a new dataset, Apache Superset enforces permission checks to prevent users from querying data they are not authorized to access. However, an authenticated attacker who holds permissions to write datasets and read charts can circumvent these checks by overwriting the SQL query of an existing dataset rather than creating a new one — a code path that does not apply the same authorization enforcement. This allows the attacker to craft arbitrary SQL queries that execute against data sources they would otherwise be denied access to (Apache OSS-Security, Red Hat).

Successful exploitation allows an authenticated low-privileged user to query data they are not authorized to access within Apache Superset, resulting in a high confidentiality impact. Sensitive data protected by Superset's row-level security and dataset permission model can be exposed to unauthorized users. There is no integrity or availability impact; the vulnerability is limited to unauthorized data read access (Apache OSS-Security, Red Hat).

1. Reconnaissance: Identify a target Apache Superset instance running a version prior to 6.0.0. Confirm the attacker's account has both dataset-write and chart-read permissions.
2. Identify an existing dataset: Browse or enumerate existing datasets within Superset that the attacker has write access to, using the Superset UI or API (GET /api/v1/dataset/).
3. Craft a malicious SQL query: Prepare a SQL query targeting a data source or table the attacker is not authorized to access under normal permission controls.
4. Overwrite the dataset SQL: Send an HTTP PUT request to the dataset update endpoint (e.g., PUT /api/v1/dataset/<id>) with the crafted SQL query in the sql field, bypassing the authorization checks that apply only during dataset creation.
5. Execute and retrieve data: Use the modified dataset in a chart or run a query against it to retrieve unauthorized data, which Superset will return without enforcing the expected access controls (Apache OSS-Security).

• Logs: Superset audit logs showing unexpected PUT /api/v1/dataset/<id> requests from low-privileged user accounts, particularly where the sql field is modified to reference tables or schemas outside the user's normal scope.
• Logs: Database query logs showing SQL queries originating from Superset service accounts accessing tables or schemas inconsistent with the user's assigned roles.
• Application Behavior: Charts or dashboards associated with datasets whose SQL queries have been recently and unexpectedly modified by non-admin users.
• Logs: Superset access logs showing a low-privileged user querying datasets they do not own or have not previously accessed.

Apache has released version 6.0.0, which fixes this vulnerability, and upgrading is the recommended remediation (Apache OSS-Security). As a workaround prior to upgrading, administrators should restrict dataset-write permissions to only trusted users who genuinely require this capability. Additionally, reviewing and auditing user role assignments to remove unnecessary dataset-write access from low-privileged accounts will reduce exposure. Monitoring audit logs for unexpected dataset SQL modifications can help detect potential abuse.

Security news outlet SecurityOnline.info covered the vulnerability as part of a broader report on five Apache Superset vulnerabilities patched in the same release cycle (SecurityOnline). The Secret CISO newsletter also noted the Apache Superset vulnerabilities in its February 25, 2026 edition. No significant independent researcher commentary or social media discussion beyond standard aggregator coverage has been observed.