CVE-2026-23982: Apache Superset Auth Bypass Vulnerability

CVE-2026-23982 Overview

An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset.

This vulnerability affects all versions of Apache Superset before 6.0.0. Users are strongly recommended to upgrade to version 6.0.0, which fixes the issue.

Critical Impact

Authenticated attackers can bypass data access controls to query unauthorized data by manipulating existing dataset SQL queries, potentially leading to sensitive data exposure across the organization.

Affected Products

• Apache Superset versions before 6.0.0

Discovery Timeline

• 2026-02-24 - CVE CVE-2026-23982 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-23982

Vulnerability Analysis

This vulnerability is classified as CWE-863 (Improper Authorization), representing a fundamental flaw in how Apache Superset validates user permissions during dataset modification operations. The authorization logic properly validates permissions when a user creates a new dataset, checking whether they have access to the underlying data sources. However, this validation is insufficient when an existing dataset's SQL query is modified.

The core issue lies in the permission check architecture: Superset verifies authorization at dataset creation time but fails to re-validate data source access rights when the SQL query content is subsequently altered. This creates a window where an attacker with legitimate but limited access can escalate their data access by hijacking existing datasets.

Root Cause

The root cause stems from incomplete authorization enforcement in the dataset modification workflow. Apache Superset implements permission checks during initial dataset creation to ensure users can only query data they are authorized to access. However, the update/edit pathway for existing datasets does not perform equivalent validation on the SQL query content.

When a user with write datasets and read charts permissions modifies an existing dataset, the application trusts that the user has appropriate access to any data sources referenced in the modified SQL query. This trust assumption bypasses the intended data access control model, allowing users to craft SQL queries that access tables and schemas beyond their authorized scope.

Attack Vector

The vulnerability is exploitable over the network by any authenticated user with minimal privileges—specifically the ability to write datasets and read charts. An attacker can exploit this vulnerability through the following mechanism:

1. The attacker authenticates to Apache Superset with a low-privileged account that has dataset write permissions and chart read permissions
2. The attacker identifies an existing dataset that references a data source they want to access
3. The attacker modifies the SQL query of this existing dataset to query unauthorized tables or data
4. Since Superset does not re-validate data source permissions on dataset updates, the modified query executes with the dataset's original access context
5. The attacker can now exfiltrate data from tables they were never authorized to query

This attack requires no user interaction and can be performed entirely through the Superset web interface or API. The attacker leverages the disconnect between creation-time authorization checks and modification-time authorization gaps to access sensitive data.

Detection Methods for CVE-2026-23982

Indicators of Compromise

• Unusual dataset modification activity from users who typically don't edit datasets
• SQL queries in datasets that reference tables or schemas inconsistent with the original dataset purpose
• Audit log entries showing dataset updates followed immediately by chart queries
• Access patterns where low-privileged users are viewing charts connected to high-sensitivity data sources

Detection Strategies

• Monitor Apache Superset audit logs for dataset modification events, particularly changes to SQL query content
• Implement alerting for dataset modifications by users whose role should not require such access
• Compare SQL query content before and after dataset modifications to detect unauthorized data source access
• Review access patterns for users with both write datasets and read charts permissions

Monitoring Recommendations

• Enable verbose logging for all dataset CRUD operations in Apache Superset
• Configure SIEM rules to correlate dataset modification events with subsequent data access patterns
• Implement periodic reviews of dataset SQL queries to identify unauthorized data source references
• Deploy database-level auditing to track queries originating from Superset against sensitive tables

How to Mitigate CVE-2026-23982

Immediate Actions Required

• Upgrade Apache Superset to version 6.0.0 or later immediately
• Audit all user accounts with combined write datasets and read charts permissions
• Review recent dataset modifications for signs of exploitation
• Consider temporarily restricting dataset write permissions to essential personnel only

Patch Information

Apache has addressed this vulnerability in version 6.0.0. Users should upgrade to this version as soon as possible. The fix implements proper authorization validation during dataset modification operations, ensuring that SQL query changes are subject to the same data access controls as new dataset creation.

For detailed information about the security fix, refer to the Apache Security Mailing List Thread and the OpenWall OSS Security Update.

Workarounds

• Restrict the write datasets permission to only trusted administrators until the upgrade can be performed
• Implement additional access controls at the database level to limit query scope regardless of Superset permissions
• Use row-level security at the database tier to provide defense-in-depth against unauthorized data access
• Consider deploying network segmentation to limit which data sources Superset can reach

# Review users with potentially dangerous permission combinations
# Apache Superset CLI command to audit roles
superset fab list-roles --permissions | grep -E "write.*dataset|read.*chart"

# Consider temporarily revoking dataset write permissions
# until upgrade to 6.0.0 is complete
superset fab remove-permission-role -r LimitedUser -p "can write on Dataset"