CVE-2026-23983: Apache Superset Data Exposure Flaw

CVE-2026-23983 Overview

A Sensitive Data Exposure vulnerability exists in Apache Superset that allows authenticated users to retrieve sensitive user information through the Tag endpoint. When enabled (disabled by default), the Tag endpoint permits users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics.

This vulnerability allows authenticated users with low privileges (e.g., Gamma role) to view sensitive authentication data, potentially leading to credential compromise and unauthorized access escalation.

Critical Impact

Authenticated users with minimal privileges can extract password hashes, email addresses, and login statistics from other users, enabling offline password cracking and targeted attacks.

Affected Products

• Apache Superset versions prior to 6.0.0
• Installations with TAGGING_SYSTEM configuration enabled
• Deployments exposing the Tag endpoint API

Discovery Timeline

• 2026-02-24 - CVE CVE-2026-23983 published to NVD
• 2026-02-25 - Last updated in NVD database

Technical Details for CVE-2026-23983

Vulnerability Analysis

This vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The flaw exists in how Apache Superset's Tag endpoint serializes User objects when returning tagged resources through the API.

When the TAGGING_SYSTEM feature is enabled and users query for objects associated with a specific tag, the API response includes User objects without proper field filtering. The serialization logic fails to exclude sensitive authentication-related fields, resulting in the exposure of:

• Password hashes - PBKDF2-derived password hashes that can be subjected to offline cracking
• Email addresses - User contact information enabling targeted phishing attacks
• Login statistics - Information about user activity patterns and login behaviors

The vulnerability requires authentication but only minimal privileges (Gamma role), making it exploitable by any authenticated user on a vulnerable instance.

Root Cause

The root cause is improper data serialization in the Tag endpoint's response handler. When User objects are included in the tagged resources response, the API fails to apply appropriate field-level access controls or output filtering. The serializer exposes internal User model attributes that should be restricted to administrative users only, including cryptographic material (password hashes) that should never be exposed through any API endpoint.

Attack Vector

The attack is network-based and requires authentication with minimal privileges. An attacker would:

1. Authenticate to Apache Superset with a low-privilege account (Gamma role is sufficient)
2. Ensure the TAGGING_SYSTEM feature is enabled on the target instance
3. Query the Tag endpoint API to retrieve objects associated with tags that include User objects
4. Extract sensitive fields from the API response, including password hashes
5. Perform offline password cracking against the extracted PBKDF2 hashes
6. Use compromised credentials for privilege escalation or lateral movement

The attack does not require user interaction and can be performed remotely. However, the feature must be explicitly enabled as it is disabled by default in Apache Superset.

Detection Methods for CVE-2026-23983

Indicators of Compromise

• Unusual API requests to Tag endpoints from low-privilege user accounts
• High volume of Tag endpoint queries attempting to enumerate tagged resources
• API responses containing serialized User objects with sensitive fields
• Evidence of offline password cracking attempts using harvested hashes

Detection Strategies

• Monitor Apache Superset access logs for excessive Tag endpoint queries from individual users
• Implement API request rate limiting and anomaly detection for the Tag endpoint
• Review authentication logs for successful logins following potential credential exposure
• Deploy application-level monitoring to detect sensitive data in API responses

Monitoring Recommendations

• Enable detailed logging for all Tag endpoint API requests
• Configure alerts for bulk data retrieval patterns from the Tag API
• Monitor for new or unusual login activity that may indicate compromised credentials
• Audit user privilege levels and access patterns regularly

How to Mitigate CVE-2026-23983

Immediate Actions Required

• Upgrade Apache Superset to version 6.0.0 or later immediately
• If upgrade is not immediately possible, ensure TAGGING_SYSTEM is set to False in configuration
• Rotate all user passwords as a precaution if the Tag endpoint was previously enabled
• Audit access logs to identify any potential exploitation of this vulnerability

Patch Information

Users are recommended to upgrade to Apache Superset version 6.0.0, which addresses this vulnerability by properly filtering sensitive fields from User objects in API responses. The official Apache security advisory is available through the Apache Mailing List Discussion. Additional details can be found in the OpenWall OSS Security Notice.

Workarounds

• Set TAGGING_SYSTEM = False in your Apache Superset configuration to disable the vulnerable endpoint
• Implement network-level access controls to restrict API access to trusted sources
• Deploy a Web Application Firewall (WAF) to filter and monitor Tag endpoint requests
• Consider implementing additional authentication layers for sensitive API endpoints

# Configuration example - Disable TAGGING_SYSTEM in superset_config.py
# Add or modify the following line in your superset_config.py file:
TAGGING_SYSTEM = False

# After configuration change, restart Apache Superset services:
# systemctl restart superset
# or
# docker-compose restart superset