CVE-2023-27524
CVE-2023-27524 is a high-severity vulnerability in Apache Superset with a CVSS 3.x base score of 8.9. It is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog, confirming it has been exploited in the wild (added 2024-01-08). The underlying weakness is classified as CWE-1188.
Key facts
- Severity: High (CVSS 3.x base score 8.9)
- EPSS exploit prediction: 97% (100th percentile)
- Actively exploited: Yes — listed in CISA KEV (added 2024-01-08)
- EU (EUVD) id: EUVD-2023-1207
- EU exploitation: Flagged exploited in the ENISA EU Vulnerability Database (since 2024-01-08)
- Weakness: CWE-1188
- Affected product: Apache Superset
- Published:
- Last modified:
Description
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config. All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your `superset_config.py` file like: SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY> Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.
Frequently asked questions
- What is CVE-2023-27524?
- Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config. All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your `superset_config.py` file like: SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY> Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.
- How severe is CVE-2023-27524?
- CVE-2023-27524 has a CVSS 3.x base score of 8.9, rated high severity. It is exploitable over network with high attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability low.
- Is CVE-2023-27524 being actively exploited?
- Yes. CVE-2023-27524 is on CISA's Known Exploited Vulnerabilities (KEV) catalog, added on 2024-01-08, which means active exploitation has been confirmed. It should be prioritised for remediation.
- What products are affected by CVE-2023-27524?
- CVE-2023-27524 affects Apache Superset. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2023-27524?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Because this CVE is known to be actively exploited, treat remediation as urgent — CISA KEV typically sets a short remediation deadline.
- Does CVE-2023-27524 have an EU (EUVD) identifier?
- Yes. CVE-2023-27524 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2023-1207. It is also flagged as exploited in the EUVD (since 2024-01-08).
- When was CVE-2023-27524 published?
- CVE-2023-27524 was published on 2023-04-24 and last updated on 2026-06-17.
References
- https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk
- https://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.html
- https://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html
- https://www.openwall.com/lists/oss-security/2023/04/24/2
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27524
Affected products (1)
- cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*
More vulnerabilities in Apache Superset
- CVE-2024-53947 — Critical (CVSS 9.8): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Superset.…
- CVE-2022-27479 — Critical (CVSS 9.8): Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Users should update to 1.4.2 or…
- CVE-2018-8021 — Critical (CVSS 9.8): Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to…
- CVE-2023-49657 — Critical (CVSS 9.6): A stored cross-site scripting (XSS) vulnerability exists in Apache Superset before 3.0.3. An authenticated attacker…
- CVE-2025-27696 — High (CVSS 8.8): Incorrect Authorization vulnerability in Apache Superset allows ownership takeover of dashboards, charts or datasets by…
- CVE-2022-43719 — High (CVSS 8.8): Two legacy REST API endpoints for approval and request access are vulnerable to cross site request forgery. This issue…
All CVEs affecting Apache Superset →
Other CWE-1188 (Insecure Default Initialization of Resource) vulnerabilities
- CVE-2026-31957 — Critical (CVSS 10.0): Himmelblau is an interoperability suite for Microsoft Azure Entra ID and Intune. From 3.0.0 to before 3.1.0, if…
- CVE-2025-41672 — Critical (CVSS 10.0): A remote unauthenticated attacker may use default certificates to generate JWT Tokens and gain full access to the tool…
- CVE-2024-0001 — Critical (CVSS 10.0): A condition exists in FlashArray Purity whereby a local account intended for initial array configuration remains active…
- CVE-2024-2912 — Critical (CVSS 10.0): An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution (RCE) by…
- CVE-2021-34795 — Critical (CVSS 10.0): Multiple vulnerabilities in the web-based management interface of the Cisco Catalyst Passive Optical Network (PON)…
- CVE-2017-7964 — Critical (CVSS 10.0): Zyxel WRE6505 devices have a default TELNET password of 1234 for the root and admin accounts, which makes it easier for…
Browse all CWE-1188 (Insecure Default Initialization of Resource) vulnerabilities →