GHSA-48m2-v2r8-h23m
NoneCVSS
—
EPSS
—
Published
Feb 24, 2026
CISA due date
—
The record
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| PyPI | apache-superset | 0 | 4.1.2 |
Related vulnerabilities
- CVE-2026-23969 Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict… Same vulnerability
- GHSA-3m2g-v7jf-7fxc Apache Superset Improper Authorization allows low-privileged users to bypass access… Also affects apache-superset
- GHSA-gvxg-9hqx-f4rg Apache Superset allows privileged users to conduct error-based SQL Injection Also affects apache-superset
- GHSA-h294-8fxm-m2pj Apache Superset allows authenticated users to view sensitive data without explicit… Also affects apache-superset
- GHSA-mwf2-qr4v-94h2 Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections Also affects apache-superset
- CVE-2026-23984 An Improper Input Validation vulnerability exists in Apache Superset that allows an… Also affects apache-superset
- CVE-2026-23983 A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated… Also affects apache-superset
- CVE-2026-23980 Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection')… Also affects apache-superset