Apache Superset: Metadata exposure in embedded charts

Vulnerability

Overview

CVE-2025-55673 describes an information disclosure vulnerability in Apache Superset, affecting versions prior to 4.1.3. When a guest user accesses a chart, the /chart/data API response includes a query field that contains the underlying SQL query. This exposes database schema details, such as table and column names, to low-privileged guest users [1][3].

Attack

Vector and Prerequisites

The vulnerability is exploitable by any guest user, who typically has limited permissions. The attacker does not need special authentication beyond guest access, and can trigger the disclosure by simply viewing a chart via the embedded analytics feature. The /chart/data endpoint inadvertently returns the full query in the payload, rather than only the query results [1][3].

Impact

A successful exploit allows a guest user to obtain sensitive metadata about the underlying database, including table names and column structures. This information could aid in planning further attacks, such as schema inference or targeted SQL injection, but does not directly expose row-level data [1][3].

Mitigation

Apache Software Foundation has addressed the issue in Superset version 4.1.3. Users are strongly advised to upgrade to this version or later to prevent the leakage of query metadata to unprivileged users [1][2][3]. No workarounds have been detailed.