Vulnerability · Published Aug 14, 2025 · Assigned by apache
CVE-2025-55674Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions
Medium 5.3
In plain English
A medium-severity SQL injection in Apache Superset from Apache Software Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 55% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| PyPI | apache-superset | 5.0.0 | GHSA-fxgf-3xh6-m2pp |
| PyPI | apache-superset | 5.0.0 | PYSEC-2026-1178 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Apache Software Foundation | Apache Superset | 0 – before 5.0.0 |
Weakness: CWE-89 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N