CVE-2025-48912: Apache Superset SQL Injection Vulnerability

CVE-2025-48912 Overview

CVE-2025-48912 is a SQL injection vulnerability [CWE-89] in Apache Superset that allows authenticated users to bypass row level security (RLS) configuration. Attackers inject SQL into sqlExpression fields and use sub-queries to evade parsing defenses. Successful exploitation grants unauthorized access to data that should be restricted by RLS policies. The flaw affects all versions of Apache Superset before 4.1.2. Because Superset is widely deployed as a data visualization and business intelligence tool, the vulnerability directly threatens the confidentiality of datasets exposed through the platform.

Critical Impact
Authenticated attackers can bypass row level security controls in Apache Superset and read data records that should be filtered out by RLS policies.

Affected Products

Apache Superset versions prior to 4.1.2
Deployments relying on row level security for tenant or dataset isolation
Any Superset instance where non-admin users have dataset query access

Discovery Timeline

2025-05-30 - CVE-2025-48912 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-48912

Vulnerability Analysis

Apache Superset uses row level security to constrain which rows a user can retrieve from a dataset. RLS rules are applied by injecting predicates into generated SQL. The vulnerability exists because the sqlExpression fields accept user-supplied SQL fragments that are not fully validated against sub-query constructs. An authenticated user with dataset access can craft an expression containing a nested SELECT statement. The parser fails to recognize the sub-query as a policy-violating construct, and the resulting query returns rows outside the user's authorized scope. The flaw undermines multi-tenant data separation and any confidentiality control built on top of RLS.

Root Cause

The root cause is incomplete SQL parsing and sanitization of the sqlExpression inputs used to define adhoc metrics, filters, and calculated columns. Superset's defensive parser inspects top-level SQL constructs but does not correctly evaluate nested sub-queries within these expressions. Attackers exploit the gap between the parser's model of allowed SQL and what the backend database actually executes.

Attack Vector

Exploitation requires network access to the Superset web interface and valid authenticated credentials with permission to query at least one dataset. The attacker submits a chart, filter, or adhoc query that includes a malicious sqlExpression payload containing a sub-query. The Superset backend forwards the rewritten SQL to the underlying database, which returns unrestricted results. No user interaction is required beyond the attacker's own session.

No verified public exploit code is available. Refer to the Apache Thread Discussion and the OpenWall OSS Security Update for technical details.

Detection Methods for CVE-2025-48912

Indicators of Compromise

Chart or filter definitions containing nested SELECT statements inside sqlExpression fields
Query logs showing sub-queries executed by users whose RLS policies should have restricted them
Unexpected row counts returned to non-admin users compared to their RLS scope
Access to datasets or tenant partitions outside the caller's assigned role

Detection Strategies

Review Superset audit logs and database query logs for sqlExpression values containing SELECT, UNION, or parenthesized sub-queries
Correlate user identity, dataset ID, and executed SQL to detect RLS predicate omissions
Alert on query patterns where the generated SQL lacks the expected RLS WHERE clause for a given role

Monitoring Recommendations

Enable verbose query logging in Superset and the backend database for all authenticated sessions
Track counts of rows returned per user per dataset and flag statistical outliers
Monitor changes to saved charts, filters, and calculated columns that introduce sub-query syntax

How to Mitigate CVE-2025-48912

Immediate Actions Required

Upgrade Apache Superset to version 4.1.2 or later on all instances
Audit existing charts, filters, and calculated columns for sub-queries inside sqlExpression fields
Rotate credentials and review data access logs for any user who could have exploited the flaw prior to patching

Patch Information

Apache has fixed the issue in Apache Superset 4.1.2. Users are recommended to upgrade to 4.1.2, which corrects the sqlExpression parsing logic and blocks sub-query bypasses of row level security. See the Apache Thread Discussion for release details.

Workarounds

Restrict dataset and SQL Lab permissions to trusted administrators until the upgrade is applied
Disable or tightly scope adhoc metrics and calculated columns for non-admin roles
Enforce database-side RLS or views so that Superset's application-layer RLS is not the sole control

bash

# Configuration example
# Upgrade Apache Superset to the patched release
pip install --upgrade "apache-superset>=4.1.2"
superset db upgrade
superset init