CVE-2026-23980

MEDIUM

Apache Superset <6.0.0 - SQL Injection

Title source: llm

Description

Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

Exploits (2)

nomisec WORKING POC

by oscar-mine · poc

https://github.com/oscar-mine/CVE-2026-23980-Exploit

View Code ZIP pw:eip

nomisec WORKING POC

by oscarmine · poc

https://github.com/oscarmine/CVE-2026-23980-Exploit

View Code ZIP pw:eip

References (2)

[Mailing List] https://lists.apache.org/thread/h4l02zw1pr2vywv0dc5zjn3grdcdhwf4

[Mailing List] http://www.openwall.com/lists/oss-security/2026/02/24/5

Scores

CVSS v3 6.5

EPSS 0.0003

EPSS Percentile 8.2%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Details

CWE

CWE-89

Status published

Products (2)

apache/superset < 6.0.0

pypi/apache-superset 0 - 6.0.0PyPI

Published Feb 24, 2026

Tracked Since Feb 24, 2026