CVE-2026-23985: 
Apache Superset vulnerability analysis and mitigation

CVE-2026-23985 is a Regular Expression Denial of Service (ReDoS) vulnerability in Apache Superset affecting versions 1.5.0 through 5.0.0 (all versions before 6.0.0). The flaw resides in the sql_parse.py component, specifically within the SQL_REGEX pattern used for parsing SQL statements in the sqlparse library integration. It was disclosed on July 30, 2026, by reporter Trung Đức Lê via the Apache security mailing list. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (Apache Advisory, GitHub Advisory, oss-security).

The root cause is classified as CWE-1333 (Inefficient Regular Expression Complexity), mapped to CAPEC-492 (Regular Expression Exponential Blowup). The vulnerable SQL_REGEX in sql_parse.py contains overlapping disjunctions that share a common outer quantifier, a classic ReDoS pattern that causes catastrophic backtracking when the regex engine processes certain inputs. An authenticated attacker can trigger this by submitting a maliciously crafted string — such as a long sequence of backslashes — to endpoints that process SQL queries (e.g., via the queries.extras.where parameter on the /api/v1/chart/data endpoint), causing the regex engine to consume excessive CPU cycles (oss-security, GitHub Advisory).

Successful exploitation causes excessive CPU consumption on the Superset server, rendering the service unresponsive or unavailable to legitimate users. The impact is limited to availability — there is no confidentiality or integrity impact, and the vulnerability does not enable data exfiltration, code execution, or lateral movement. Because authentication is required, the attack surface is constrained to users with valid credentials, though low-privilege accounts are sufficient (GitHub Advisory, oss-security).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (GitHub Advisory). The NVD SSVC assessment confirms exploitation is "none" and the vulnerability is not automatable. The EPSS score is approximately 0.26–0.41%, placing it in the lower percentiles for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Apache Advisory).

1. Authenticate: Obtain valid credentials for an Apache Superset instance running versions 1.5.0–5.0.0 (any low-privilege account is sufficient).
2. Identify the target endpoint: Locate the /api/v1/chart/data API endpoint, which accepts SQL query parameters including queries.extras.where.
3. Craft the malicious payload: Construct a request body containing an excessively long sequence of backslashes or similar repeated characters in the queries.extras.where parameter, designed to trigger catastrophic backtracking in the SQL_REGEX pattern within sql_parse.py.
4. Send the request: Submit the crafted HTTP POST request to /api/v1/chart/data with the malicious payload.
5. Trigger DoS: The regex engine enters exponential backtracking, consuming CPU resources and causing the Superset service to become unresponsive or crash, denying service to other users (oss-security, GitHub Advisory).

• Network: Repeated HTTP POST requests to /api/v1/chart/data from a single authenticated user, particularly with unusually large or malformed queries.extras.where parameter values containing long sequences of backslashes or repeated special characters.
• Logs: Superset access logs showing high-frequency requests to /api/v1/chart/data with abnormally large request bodies; application logs showing slow or timed-out SQL parsing operations.
• Process/System: Sustained high CPU utilization on the Superset server process (e.g., Python/Gunicorn workers) without a corresponding increase in legitimate query volume; worker process timeouts or restarts.

The primary remediation is to upgrade Apache Superset to version 6.0.0 or later, which contains the fix developed by Beto de Almeida (oss-security). If immediate patching is not feasible, two workarounds are recommended: (1) deploy WAF rules to detect and block requests containing excessively long sequences of backslashes or suspicious repeated patterns in the queries.extras.where parameter; and (2) enforce strict rate limiting on the /api/v1/chart/data endpoint to reduce the impact of potential abuse (GitHub Advisory, Apache Advisory).

The vulnerability was publicly disclosed by Daniel Gaspar of the Apache Superset project via the oss-security mailing list on July 30, 2026, crediting Trung Đức Lê as the reporter (oss-security). No notable independent researcher commentary, social media discussion, or significant media coverage has been identified beyond standard vulnerability database aggregation.