Critical Apache Superset SQL Injection Vulnerability Gets Public PoC

Key Takeaways

• A public proof-of-concept (PoC) exploit has been released for CVE-2026-23980, a critical SQL injection vulnerability.
• The flaw impacts Apache Superset versions prior to 6.0.0, an open-source data exploration and visualization platform.
• Authenticated users with read-level access can exploit the vulnerability to trigger error-based SQL injection.
• The vulnerability allows attackers to extract sensitive database information, potentially leading to further data compromise.
• Apache has released Superset version 6.0.0 to address the issue, and immediate upgrades are strongly advised.

Public PoC Emerges for Critical Apache Superset SQL Injection Flaw

A publicly available proof-of-concept (PoC) exploit has been published for CVE-2026-23980, a significant SQL injection vulnerability affecting Apache Superset. This flaw could enable authenticated users, even those with only read-level access, to execute error-based SQL injection attacks by manipulating specific application parameters.

Apache Superset is a widely adopted open-source platform designed for data exploration, visualization, and building business intelligence dashboards. Its ability to connect to various enterprise data sources means that SQL injection vulnerabilities within its query-handling mechanisms pose a substantial risk to organizations, particularly those with multi-user Superset deployments.

The vulnerability, identified as CVE-2026-23980, falls under the category of Improper Neutralization of Special Elements used in a SQL Command, commonly known as SQL injection.

Details of the Vulnerability

According to the Apache Superset advisory, the flaw resides in the application’s handling of the sqlExpression and where parameters. An attacker with valid authentication and read permissions could craft malicious input for these parameters, causing the application to generate database errors. These error messages can inadvertently expose critical information about the underlying database structure, including query logic, table names, and column names.

Such information, obtained through error-based SQL injection, can be invaluable to an attacker. Depending on the specific Superset deployment and its connected data sources, this knowledge could facilitate subsequent attempts to access or infer sensitive data records. The vulnerability affects all Apache Superset releases from version 0.0.0 up to, but not including, version 6.0.0.

Apache has since released Superset version 6.0.0, which contains the necessary patch to remediate this vulnerability. The vendor strongly advises all users to upgrade to this fixed version without delay.

Exploit Code Now Public

In a development that heightens the urgency for patching, security researchers have made public a repository containing a modified exploit for CVE-2026-23980. This repository includes a Python script, exploit.py, confirming that technical details and functional proof-of-concept code are now openly accessible. The availability of a PoC significantly lowers the barrier for potential attackers, enabling them to more easily test and exploit vulnerable Superset instances.

The discovery of this vulnerability is credited to Pritam Chakkerwar, with Dhanush Nayak reporting the issue, and Pedro Sousa developing the remediation. Apache officially disclosed the vulnerability in a security notice published on February 24, 2026.

What You Should Do

• Upgrade Immediately: All organizations running Apache Superset must upgrade to version 6.0.0 or later as soon as possible to mitigate this critical SQL injection vulnerability.
• Identify All Instances: Conduct an inventory to identify all deployed Apache Superset instances within your environment and confirm their installed versions.
• Review User Permissions: Scrutinize user accounts with dashboard and dataset read permissions, especially in environments where Superset connects to production databases or handles confidential business information. Consider implementing the principle of least privilege.
• Monitor Logs for Anomalies: Implement robust logging and monitoring for application and proxy logs. Look for unusual requests involving the sqlExpression or where parameters, repeated malformed query attempts, database error responses, unexpected SQL syntax fragments, or any abnormal activity originating from authenticated, low-privilege accounts. These could indicate attempted exploitation.
• Do Not Underestimate Read-Only Access: Even though the vulnerability requires authentication, read-only access should not be considered harmless. In data analytics platforms, limited user privileges can still be leveraged to gain valuable information or influence backend queries if an attacker can manipulate SQL input.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.