Apache Superset: Sensitive Data Exposure via REST API (disabled by default)

Vulnerability

Description

CVE-2026-23983 is a sensitive data exposure vulnerability in Apache Superset affecting versions before 6.0.0 [1][3]. The root cause lies in the Tag endpoint, which is disabled by default but, when enabled, allows authenticated users to retrieve objects associated with a tag [1]. If those objects include User entities, the API response improperly serializes and returns sensitive authentication data, specifically PBKDF2 password hashes, email addresses, and login statistics [1][3].

Exploitation

Prerequisites

Exploitation requires the attacker to be an authenticated user, including those with the low-privilege Gamma role [1][3]. The feature must be explicitly enabled by an administrator (TAGGING_SYSTEM set to True), as it is disabled by default [1][3]. An attacker would craft a request to the Tag endpoint for a tag associated with user objects, thereby receiving the serialized sensitive fields [1].

Impact

If exploited, an attacker gains access to password hashes (PBKDF2), which could be cracked offline, as well as email addresses and login statistics [1][3]. This could lead to account takeover or further credential-based attacks, depending on the privilege level exposed. The confidentiality of user authentication data is compromised, and the issue is rated with a CVSS score (not fully detailed but noted as a security risk) [1].

Mitigation

Apache Superset has fixed the issue in version 6.0.0 [1][3]. Users are strongly recommended to upgrade immediately. As an alternative, administrators should ensure the TAGGING_SYSTEM configuration remains set to False (the default) to disable the vulnerable endpoint entirely [1][3].