Apache Superset SQL Injection Flaw Gets Public PoC Exploit
A public Python proof-of-concept exploit was released for CVE-2026-23980, an authenticated error-based SQL injection flaw in Apache Superset before 6.0.0.
A public proof-of-concept exploit repository now targets CVE-2026-23980, an error-based SQL injection affecting Apache Superset versions from 0.0.0 up to but not including 6.0.0. An authenticated user with read access can inject SQL through the sqlExpression or where parameters, potentially reaching business, customer, and security data depending on database configuration and privileges. Apache disclosed the flaw in February and urges upgrading to Superset 6.0.0; compensating controls include least-privilege database accounts, network restrictions, and log monitoring.
- CVE-2026-23980 affects all Apache Superset versions before 6.0.0, disclosed in February.
- Exploitation requires an authenticated account with read access; impact varies by database configuration.
- Public PoC lowers the bar for attackers probing internet-facing Superset dashboards.
- Upgrade to 6.0.0; restrict access and monitor logs until patched.
- CVEs
- CVE-2026-23980
- Vendors
- Apache
- Products
- Apache Superset
- Organizations
- Apache SupersetApache
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-23980 | Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read… | 5.3 | <1% | PoC |
From the original article
2 min read at gbhackers.com
A public proof-of-concept exploit has been released for CVE-2026-23980, a SQL injection vulnerability affecting Apache Superset installations running versions earlier than 6. 0. 0.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.