Public PoC Released for Apache Superset SQL Injection Vulnerability CVE-2026-23980

A public Python proof-of-concept exploit is now available for CVE-2026-23980, an authenticated error-based SQL injection (CWE-89) affecting all Apache Superset versions before 6.0.0. Organizations should upgrade to Superset 6.0.0 and restrict/monitor access…

CVE-2026-23980 is an error-based SQL injection flaw (CWE-89) in Apache Superset affecting all releases before 6.0.0 (per one source, versions 0.0.0 up to but not including 6.0.0). Authenticated users with read-level access can inject SQL through the sqlExpression or where parameters; the error-based technique can reveal query structure and database schema, and impact varies by database configuration and privileges, potentially reaching business, customer, and security data. Apache disclosed the issue on February 24, 2026 and fixed it in Superset 6.0.0. A public repository containing a Python exploit.py proof-of-concept has now been released, lowering the effort required to attack internet-facing Superset dashboards. Defenders should upgrade to 6.0.0, apply compensating controls (least-privilege database accounts, network restrictions), and monitor proxy and application logs for repeated malformed query requests, database errors, and unusual activity from low-privilege accounts.

• CVE-2026-23980 is an error-based SQL injection (CWE-89) in Apache Superset affecting all versions before 6.0.0 (described as 0.0.0 up to but not including 6.0.0).
• Injection occurs via the sqlExpression and where parameters and requires an authenticated account with read-level access.
• The error-based technique can reveal query structure and schema; impact depends on database configuration and privileges, potentially exposing business, customer, and security data.
• A public repository with a Python exploit.py proof-of-concept has been released, lowering the exploitation effort against exposed instances.
• Apache disclosed the issue on February 24, 2026 and fixed it in Apache Superset 6.0.0.
• Recommended actions: upgrade to 6.0.0, use least-privilege database accounts, restrict network access, and monitor proxy/app logs for repeated malformed queries, database errors, and unusual activity from low-privilege accounts.