Apache Superset: Metadata db write access can lead to remote code execution
Description
If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend.
The Superset metadata db is an 'internal' component that is typically only accessible directly by the system administrator and the superset process itself. Gaining access to that database should be difficult and require significant privileges.
This vulnerability impacts Apache Superset versions 1.5.0 up to and including 2.1.0. Users are recommended to upgrade to version 2.1.1 or later.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Write access to Apache Superset metadata database allows remote code execution via crafted Python object persistence.
This vulnerability in Apache Superset (versions 1.5.0 through 2.1.0) allows an attacker with write access to the metadata database to persist a specially crafted Python object, leading to remote code execution on the Superset web backend [1].
The metadata database is an internal component typically only accessible directly by the system administrator and the Superset process itself, making exploitation difficult and requiring significant privileges [1].
Successful exploitation allows an attacker to execute arbitrary code on the Superset web backend, potentially compromising the entire system [1].
Users are advised to upgrade to Apache Superset version 2.1.1 or later, which contains a fix for this vulnerability [1]. The project is actively maintained on GitHub [2].
AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
apache-supersetPyPI | >= 1.5.0, < 2.1.1 | 2.1.1 |
Affected products
3- osv-coords2 versions
>= 1.5.0, < 2.1.1+ 1 more
- (no CPE)range: >= 1.5.0, < 2.1.1
- (no CPE)range: >= 1.5.0, < 2.1.1
- Apache Software Foundation/Apache Supersetv5Range: 1.5.0
Patches
0No patches discovered yet.
Vulnerability mechanics
AI mechanics synthesis has not run for this CVE yet.
References
4News mentions
0No linked articles in our index yet.