CVE-2026-23983: 
Apache Superset vulnerability analysis and mitigation

CVE-2026-23983 is a Sensitive Data Exposure vulnerability in Apache Superset affecting all versions before 6.0.0. When the Tag endpoint (disabled by default via TAGGING_SYSTEM = False) is enabled and tag-associated objects include Users, the API response improperly serializes and returns sensitive fields — including PBKDF2 password hashes, email addresses, and login statistics — to any authenticated low-privilege user (e.g., Gamma role). The vulnerability was reported by Krzysztof Maurek, disclosed on February 24, 2026, and carries a CVSS v3.1 base score of 6.5 (Medium) (oss-security, Red Hat CVE).

The root cause is improper object serialization in the Tag endpoint's API response handler, classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). When the TAGGING_SYSTEM feature flag is enabled and a tag is associated with User objects, the REST API response includes fields from the User model that should be restricted — specifically password hashes (pbkdf2), email addresses, and login statistics — without applying appropriate field-level access controls. The attack vector is network-based, requires low privileges (a valid authenticated session), no user interaction, and low attack complexity, making it straightforward to exploit on any Superset instance with the tagging feature enabled (oss-security, Red Hat CVE).

Successful exploitation allows authenticated low-privilege users to retrieve PBKDF2 password hashes, email addresses, and login statistics for other users registered in the Superset instance. Exposed password hashes could be subjected to offline cracking attacks, potentially enabling account takeover of higher-privileged users including administrators. The impact is limited to confidentiality — there is no integrity or availability impact — but the exposure of credential material significantly elevates the risk of further compromise (oss-security, Red Hat CVE).

1. Reconnaissance: Identify Apache Superset instances running versions before 6.0.0 with the TAGGING_SYSTEM feature flag enabled (non-default configuration).
2. Authentication: Obtain a valid low-privilege account (e.g., Gamma role) on the target Superset instance — this could be a legitimate account or a compromised one.
3. Identify tags associated with users: Query the Tag API endpoint (e.g., GET /api/v1/tag/) to enumerate available tags and identify any tags associated with User objects.
4. Retrieve sensitive user data: Send an authenticated API request to the Tag endpoint for a tag linked to User objects (e.g., GET /api/v1/tag/<tag_id>/items/). The API response will improperly serialize and return sensitive User fields including PBKDF2 password hashes, email addresses, and login statistics.
5. Offline credential cracking: Extract the returned PBKDF2 password hashes and attempt offline cracking using tools such as Hashcat or John the Ripper to recover plaintext passwords for privilege escalation or lateral movement (oss-security).

• Network: Unusual or repeated authenticated GET requests to Tag-related API endpoints (e.g., /api/v1/tag/ or /api/v1/tag/<id>/items/) from low-privilege user accounts, particularly if the TAGGING_SYSTEM feature is not expected to be in active use.
• Logs: Superset access logs showing low-privilege users (Gamma role) querying tag item endpoints at unusual times or frequencies; API responses with abnormally large payloads from tag endpoints may indicate user object serialization.
• Application: Presence of TAGGING_SYSTEM = True in Superset configuration on instances where it was not intentionally enabled.

The primary remediation is to upgrade Apache Superset to version 6.0.0 or later, which fixes the improper serialization in the Tag endpoint. As an immediate workaround for organizations unable to upgrade, ensure the TAGGING_SYSTEM configuration flag is set to False — this is the current default and disables the vulnerable endpoint entirely. Organizations should also audit their Superset configuration to confirm the tagging feature is not inadvertently enabled in production environments (oss-security, Apache Mailing List).

Security Online Info covered the disclosure as part of a broader report on five vulnerabilities patched in Apache Superset, noting the significance of the security overhaul in version 6.0.0 (Security Online). The vulnerability was reported to the Apache Security Team by researcher Krzysztof Maurek, with remediation developed by Daniel Gaspar of the Apache Superset project (oss-security). Qualys added detection for this CVE in their March 2026 application security detections update (detection ID 531050).