CVE-2026-23984: 
Apache Superset vulnerability analysis and mitigation

CVE-2026-23984 is an Improper Input Validation / Incorrect Authorization vulnerability in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check on PostgreSQL database connections. The flaw affects all versions of Apache Superset before 6.0.0. It was disclosed on February 24, 2026, by Daniel Gaspar via the oss-security mailing list, with credit to reporter Trung Đức Lê. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 7.1 (High) (Red Hat CVE, oss-security).

The root cause is classified as CWE-863 (Incorrect Authorization). Apache Superset's SQLLab feature is designed to enforce read-only mode on certain PostgreSQL database connections by blocking standard DML statements such as INSERT, UPDATE, and DELETE. However, the validation logic fails to detect these operations when they are embedded within specially crafted SQL statements — for example, through SQL constructs that obfuscate or wrap DML commands in ways the parser does not recognize as restricted. An authenticated attacker with SQLLab access can exploit this by submitting such crafted queries over the network without requiring any additional privileges or user interaction (oss-security, Red Hat CVE).

Successful exploitation allows an authenticated attacker to perform unauthorized data modification operations (INSERT, UPDATE, DELETE) on PostgreSQL databases that are configured as read-only within Apache Superset. The primary impact is a high integrity loss, as data in connected PostgreSQL databases can be altered or corrupted without authorization. Confidentiality and availability are not directly impacted by this vulnerability, but unauthorized write access could be leveraged to tamper with business-critical data or introduce malicious records into downstream systems (Red Hat CVE, oss-security).

1. Reconnaissance: Identify Apache Superset instances running versions prior to 6.0.0 that have SQLLab enabled and use PostgreSQL database connections configured as read-only.
2. Authentication: Log in to the Superset instance using a valid account that has been granted SQLLab access.
3. Craft bypass SQL: Construct a SQL statement that embeds DML operations (e.g., INSERT, UPDATE, DELETE) in a form not recognized by Superset's read-only validation logic — for example, using CTEs (Common Table Expressions), subqueries, or other PostgreSQL-specific syntax that wraps the DML command.
4. Submit query: Execute the crafted SQL statement via the SQLLab interface against the target read-only PostgreSQL connection.
5. Achieve unauthorized write: The DML operation bypasses the read-only check and is executed against the PostgreSQL database, resulting in unauthorized data modification (oss-security).

• Logs: Apache Superset application logs showing SQLLab query executions by users on read-only PostgreSQL connections that contain DML keywords (INSERT, UPDATE, DELETE) embedded in complex SQL constructs such as CTEs or nested subqueries.
• Database Logs: PostgreSQL server logs (pg_log) recording unexpected write operations (INSERT, UPDATE, DELETE) originating from the Superset database user on connections or roles designated as read-only.
• Network: Unusual or repeated SQLLab API requests (e.g., POST to /api/v1/sqllab/execute/) from authenticated users, particularly those not typically associated with write activity.
• Application Behavior: Unexpected data changes in PostgreSQL tables connected to Superset as read-only sources, detected via database auditing or integrity monitoring tools.

The Apache Software Foundation has released Apache Superset 6.0.0, which fixes this vulnerability. All users running versions prior to 6.0.0 are strongly recommended to upgrade immediately. No official configuration-based workaround has been published; the primary remediation is upgrading to the patched release. As an interim measure, administrators may consider restricting SQLLab access to trusted users only and reviewing PostgreSQL database user permissions to enforce read-only access at the database level rather than relying solely on Superset's application-layer enforcement (oss-security, Red Hat CVE).

The vulnerability was covered by SecurityOnline.info as part of a broader report on five vulnerabilities patched in Apache Superset 6.0.0, noting it as a significant security overhaul for the project (SecurityOnline). The Secret CISO newsletter also highlighted the Apache Superset vulnerabilities in its February 25, 2026 edition alongside other notable breaches (Secret CISO). No significant social media controversy or notable researcher commentary beyond the initial disclosure has been observed.