CVE-2025-55673: Apache Superset Information Disclosure Flaw

CVE-2025-55673 Overview

CVE-2025-55673 is an information disclosure vulnerability in Apache Superset affecting all versions before 4.1.3. When a guest user accesses a chart, the API response from the /chart/data endpoint includes a query field in its payload. This field exposes the underlying SQL query, which discloses database schema details such as table and column names to low-privileged guest accounts. The flaw maps to [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor]. The Apache Superset project assigned the issue a medium severity rating and released a fix in version 4.1.3.

Critical Impact
Guest users can enumerate backend database schema information through chart API responses, aiding reconnaissance for follow-on attacks.

Affected Products

Apache Superset versions prior to 4.1.3
Deployments exposing embedded dashboards or charts to guest users
Multi-tenant Superset instances relying on guest tokens for external chart embedding

Discovery Timeline

2025-08-14 - CVE CVE-2025-55673 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55673

Vulnerability Analysis

Apache Superset supports guest tokens that permit limited, scoped access to embedded dashboards and charts. These tokens are intended to restrict the user to viewing rendered data, not to inspect backend query construction. The /chart/data endpoint returns a JSON payload containing not only the result set but also a query field with the compiled SQL statement executed against the data source.

For an authenticated guest, this query field reveals table names, column identifiers, join relationships, filter predicates, and any schema-qualified references used by the chart. An attacker holding a guest token can enumerate the backend schema without any direct database privileges. This exposure provides reconnaissance value for planning SQL injection attempts, privilege escalation, or targeted data exfiltration against other components.

The attack is network-reachable, requires low privileges, and needs no user interaction.

Root Cause

The root cause is an authorization gap in response serialization. The chart data serializer does not strip or redact the query attribute based on the requesting principal's role. Guest users receive the same payload shape as privileged dashboard owners, violating least-privilege disclosure boundaries.

Attack Vector

An attacker with a valid guest token submits a POST request to the /api/v1/chart/data endpoint for any chart accessible through an embedded dashboard. The response JSON includes a query key containing the raw SQL text. No elevated role, dataset ownership, or SQL Lab access is required. The vulnerability is remotely exploitable over HTTPS wherever the Superset instance is reachable.

No verified public proof-of-concept has been published. The vulnerability mechanism is described in the Apache Mailing List Thread and the Openwall OSS-Security Update.

Detection Methods for CVE-2025-55673

Indicators of Compromise

Repeated POST requests to /api/v1/chart/data originating from guest-token sessions targeting multiple chart IDs in sequence.
Access patterns from embedded dashboard contexts that enumerate chart identifiers outside the expected dashboard scope.
Unusual volume of chart data requests from a single guest JWT within a short interval.

Detection Strategies

Inspect Superset access logs for guest-authenticated calls to /api/v1/chart/data and correlate with the breadth of chart IDs accessed per session.
Deploy a reverse-proxy or WAF rule that logs or alerts on /chart/data responses containing the query JSON key when the session principal is a guest.
Review audit logs for guest tokens issued with broad resources scopes that enable iteration across unrelated charts.

Monitoring Recommendations

Instrument Superset with structured logging for the ChartDataRestApi endpoint and forward events to a centralized analytics pipeline.
Track baseline request rates per guest token and alert on deviations suggestive of schema enumeration.
Monitor outbound SQL warehouse logs for query patterns that mirror schema reconnaissance activity against datasets referenced by embedded charts.

How to Mitigate CVE-2025-55673

Immediate Actions Required

Upgrade Apache Superset to version 4.1.3 or later as the primary remediation.
Audit all active guest tokens and revoke tokens with excessive chart or dashboard scope.
Restrict network exposure of the Superset /api/v1/chart/data endpoint to trusted egress paths where feasible.

Patch Information

The Apache Superset project resolved CVE-2025-55673 in version 4.1.3. The fix suppresses the query field in /chart/data responses returned to guest users. Upgrade instructions and release notes are available via the Apache Mailing List Thread.

Workarounds

Place a reverse proxy in front of Superset that strips the query field from /api/v1/chart/data responses when the session is guest-authenticated.
Disable guest-token issuance for environments that do not require embedded dashboards until the upgrade is applied.
Narrow guest token resources arrays to only the specific dashboard IDs required, limiting the attack surface for schema enumeration.

bash

# Upgrade Apache Superset using pip
pip install --upgrade "apache-superset>=4.1.3"
superset db upgrade
superset init
systemctl restart superset