CVE-2026-23984: apache software foundation apache superset Incorrect Authorization

Vulnerability summary

CVE-2026-23984 is a high (CVSS 7.1) Incorrect Authorization vulnerability in apache software foundation apache superset. EPSS estimates a 0.36% chance of exploitation in the next 30 days, higher than 28.3% of scored vulnerabilities.

Timeline

1. 24-02-2026
   PublishedVulnerability first disclosed.
2. 24-02-2026
   Last modifiedVulnerability information updated.

Description

An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

• CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.