Apache Superset: Improper Neutralization of Special Elements used in a SQL Command

Overview

CVE-2026-23980 describes an improper neutralization of special elements used in a SQL command (SQL injection) vulnerability in Apache Superset. The flaw exists because user-supplied input passed through the sqlExpression or where parameters is not properly sanitized before being incorporated into database queries. This allows an authenticated attacker with read access to inject malicious SQL statements that are executed by the backend database server [1][3].

Exploitation

An attacker must be an authenticated user of Apache Superset with at least read privileges. The attack is performed by crafting a specially formed request that includes dangerous SQL syntax in either the sqlExpression or where parameters. Since these parameters are used directly in constructing SQL queries without proper neutralization, the injected code becomes part of the query execution context. The vulnerability is classified as error-based SQL injection, meaning the attacker can extract information through error messages returned by the database [1][3].

Impact

Successful exploitation enables the attacker to view, modify, or delete data in the underlying database that the application connects to. Depending on the database user's privileges, the attacker may also be able to execute administrative operations, potentially leading to a full compromise of the database. The confidentiality, integrity, and availability of the data managed by Superset are all at risk [1].

Mitigation

Apache Software Foundation has released version 6.0.0 of Apache Superset, which remediates the vulnerability by properly escaping and parameterizing input to the affected parameters. Users must upgrade to version 6.0.0 or later. There are no workarounds available [1][3].