Ce mail provient de l'extérieur, restons vigilants

=====================================================================


                            CERT-Renater

                Note d'Information No. 2026/VULN817
_____________________________________________________________________

DATE                : 04/08/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Apache Superset versions prior
                                     to 6.0.0.
 
=====================================================================
https://lists.apache.org/thread/p1c3obc9goq50t9mokq4tf41dz1o7c5y
https://lists.apache.org/thread/cpklslk3dby5dyw59f54ft5tf5t8pr3m
_____________________________________________________________________

CVE-2026-23981: Apache Superset: Improper Authorization in Chart
Update allowing Dashboard Modification

Severity: 

Affected versions:

- Apache Superset 0.0.0 before 6.0.0

Description:

An Improper Authorization vulnerability exists in Apache Superset
allowing an authenticated user with permissions to update charts to
modify dashboards they do not own. When updating a chart's properties
via the REST API, a user can provide a list of dashboard IDs
(dashboards) to associate the chart with. The validation logic in
the UpdateChartCommand failed to verify that the user had write
permissions for the target dashboards specified in the request
body. 

This issue affects Apache Superset: before 6.0.0.

Users are recommended to upgrade to version 6.0.0, which fixes
the issue.

Credit:

Đỗ Thành Đạt (reporter)
Daniel Gaspar (remediation developer)

References:

https://superset.apache.org
https://www.cve.org/CVERecord?id=CVE-2026-23981

_____________________________________________________________________

CVE-2026-23985: Apache Superset: Regular Expression Denial of Service
(ReDoS) in SQL Parser

Severity: 

Affected versions:

- Apache Superset before 6.0.0

Description:

A Regular Expression Denial of Service (ReDoS) vulnerability exists in
Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is
located in the sql_parse.py component, specifically within the
SQL_REGEX used for parsing SQL statements in the sqlparse library
integration.

The affected regular expression contains overlapping disjunctions that
share a common outer quantifier. An authenticated attacker can exploit
this by sending a maliciously crafted input string (specifically a
long sequence of backslashes or similar characters) to endpoints that
process SQL queries

This issue affects Apache Superset: before 6.0.0.

Users are recommended to upgrade to version 6.0.0, which fixes the
issue. 

Workarounds:

● WAF Rules: Implement Web Application Firewall (WAF) rules to detect
and block requests containing excessively long sequences of backslashes
or suspicious repeated patterns in the queries.extras.where parameter.
● Rate Limiting: Ensure strict rate limiting is applied to the
/api/v1/chart/data endpoint to reduce the impact of potential
attacks.

Credit:

Trung Đức Lê (reporter)
Beto de Almeida (remediation developer)

References:

https://superset.apache.org
https://www.cve.org/CVERecord?id=CVE-2026-23985


=========================================================

+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================