medium5.3
CVE-2026-23980
Apache Superset allows privileged users to conduct error-based SQL Injection
Impact
Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| pip | apache-superset | < 6.0.0 | 6.0.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Apache | Superset | before 6.0.0 |