Public Exploit Released for Apache Superset SQL Injection Vulnerability (CVE-2026-23980)
A public proof-of-concept exploit is now available for CVE-2026-23980, a SQL injection vulnerability in Apache Superset versions prior to 6.0.0, increasing the urgency for organizations to patch.
A public proof-of-concept exploit has been released for CVE-2026-23980, a critical SQL injection vulnerability affecting Apache Superset versions prior to 6.0.0. The flaw allows authenticated users with read-level access to trigger error-based SQL injection through specific application parameters, potentially exposing sensitive database information.
Apache Superset is a widely used open-source platform for data exploration and visualization, enabling users to build dashboards, query databases, and share business intelligence reports. Given its ability to connect to sensitive enterprise data sources, vulnerabilities in its query-handling functions pose significant security risks, especially for instances exposed to multiple users.
The vulnerability, officially tracked as CVE-2026-23980, is categorized as an Improper Neutralization of Special Elements used in a SQL Command issue, commonly known as SQL injection. According to the Apache Superset advisory, the vulnerability lies within the handling of the sqlExpression and where parameters. An authenticated attacker with read access can supply specially crafted input to these parameters, causing the application to return database errors.
Error-based SQL injection techniques can provide attackers with valuable insights into the underlying query structure, database behavior, table names, column names, and other sensitive details. This information can then be leveraged to facilitate further attempts to access or infer confidential records, depending on the specific deployment and the data accessible by the Superset instance.
The vulnerability impacts all Apache Superset releases from version 0.0.0 up to, but not including, version 6.0.0. Apache has addressed this critical issue by releasing version 6.0.0 and strongly recommends that all users upgrade to this fixed release as soon as possible to mitigate the risk.
Security researchers have published a public repository containing a modified exploit for CVE-2026-23980, including a Python file named exploit.py. The availability of this proof-of-concept code significantly lowers the barrier for attackers to test and exploit exposed Superset environments, making prompt patching a critical priority for defenders.
The vulnerability was credited to Pritam Chakkerwar for discovery, Dhanush Nayak for reporting, and Pedro Sousa for developing the remediation. Apache disclosed the issue in a security notice posted on February 24, 2026. Organizations running Apache Superset should immediately identify all instances, verify their installed versions, and prioritize upgrading to version 6.0.0.
Administrators should also review user accounts with dashboard and dataset read permissions, particularly in environments where Superset connects to production databases or handles confidential business information. Monitoring application and proxy logs for unusual requests involving the sqlExpression or where parameters, such as repeated malformed queries, database error responses, or abnormal activity from low-privilege accounts, may indicate attempted exploitation.