CVE-2025-55675: Apache Superset Information Disclosure Flaw

CVE-2025-55675 Overview

Apache Superset contains an improper access control vulnerability [CWE-285] in its /explore endpoint. A missing authorization check allows authenticated users to discover metadata about datasources they do not have permission to access. By iterating through the datasource_id parameter in the URL, an attacker can enumerate protected datasources and confirm their existence and names. This leads to sensitive information disclosure about the internal data architecture of a Superset deployment.

The issue affects all Apache Superset versions prior to 5.0.0. The Apache Software Foundation recommends upgrading to version 5.0.0, which contains the fix.

Critical Impact

Any authenticated Superset user can enumerate the names and existence of restricted datasources, exposing sensitive schema and dataset information to users without proper authorization.

Affected Products

• Apache Superset versions prior to 5.0.0
• All deployments exposing the /explore endpoint to authenticated users
• Multi-tenant Superset installations with role-based datasource restrictions

Discovery Timeline

• 2025-08-14 - CVE CVE-2025-55675 published to NVD
• 2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-55675

Vulnerability Analysis

Apache Superset enforces role-based access control over datasources, allowing administrators to restrict which datasets a user can query or visualize. The /explore endpoint, which powers Superset's chart creation workflow, accepts a datasource_id parameter identifying the target dataset. The vulnerable code path returns metadata about the referenced datasource without first verifying that the requesting user holds the required permissions.

An authenticated attacker iterates through sequential datasource_id values and observes the server response. Responses differ based on whether a datasource exists, allowing the attacker to build an inventory of protected datasets. The returned metadata can include dataset names and other identifying attributes, exposing the internal data model of the Superset instance.

While the flaw does not permit direct data extraction from the underlying databases, enumeration of sensitive dataset names is often sufficient to inform follow-on attacks. Discovery of names such as payroll_2025 or pii_customers provides reconnaissance value for targeted social engineering or privilege escalation attempts.

Root Cause

The root cause is a missing authorization check in the /explore endpoint handler. The code resolves the datasource from the supplied identifier and returns metadata before evaluating the user's datasource-level permissions. This violates the principle of complete mediation, where every access to a protected object must be checked against the subject's authorizations.

Attack Vector

Exploitation requires only low-privileged authenticated access. The attacker sends HTTP GET requests to the /explore endpoint while varying the datasource_id query parameter. By comparing response codes, lengths, or content, the attacker distinguishes valid datasource identifiers from invalid ones and extracts the associated names.

No verified public exploit is listed in Exploit-DB, and the CVE is not present on the CISA Known Exploited Vulnerabilities catalog. Detailed technical context is published on the Apache Mailing List Discussion and the OpenWall OSS Security Update.

Detection Methods for CVE-2025-55675

Indicators of Compromise

• Sequential or high-volume HTTP GET requests to /explore or /explore/ with incrementing datasource_id values from a single authenticated session
• Access patterns where a user queries datasource_id values that are not associated with any dashboards or saved charts owned by that user
• Unusual spikes in 4xx responses from the /explore endpoint, indicating enumeration against non-existent IDs

Detection Strategies

• Review Superset web server access logs for repeated requests to /explore from the same session identifier within short time windows
• Correlate /explore request volume per user against their assigned datasource permissions in Superset's role model
• Deploy a web application firewall rule that rate-limits requests to the /explore endpoint per authenticated session

Monitoring Recommendations

• Ingest Superset application and reverse-proxy logs into a centralized logging platform for behavioral analytics
• Alert on any single user accessing more than a defined threshold of unique datasource_id values within a rolling window
• Audit Superset user activity reports regularly to identify accounts querying datasources outside their business function

How to Mitigate CVE-2025-55675

Immediate Actions Required

• Upgrade Apache Superset to version 5.0.0 or later, which contains the authorization fix for the /explore endpoint
• Audit existing Superset user accounts and remove inactive or over-privileged authenticated users
• Review datasource naming conventions and avoid embedding sensitive context (such as classification labels) in dataset names

Patch Information

The Apache Superset project resolved the issue in version 5.0.0. The patch introduces the missing authorization check in the /explore endpoint so that requests for datasources outside the user's permission scope are rejected before any metadata is returned. Refer to the Apache Mailing List Discussion for the official announcement.

Workarounds

• Place Apache Superset behind an authenticating reverse proxy and restrict /explore access to trusted internal networks
• Apply rate limiting at the reverse-proxy layer to slow enumeration attempts against the datasource_id parameter
• Reduce the attack surface by granting the minimum set of roles required for each user and removing default Gamma or sql_lab roles where not needed

# Example nginx rate limit for the /explore endpoint
limit_req_zone $binary_remote_addr zone=superset_explore:10m rate=10r/m;

server {
    location /explore {
        limit_req zone=superset_explore burst=5 nodelay;
        proxy_pass http://superset_backend;
    }
}