CVE-2026-23969

UNKNOWN 0.0

Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue.

CWE	CWE-89
Vendor	apache software foundation
Product	apache superset
Published	Feb 24, 2026
Last Updated	Feb 24, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache superset

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache superset are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Superset

0.0.0 < 4.1.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/2q22sp4oj3krcgdkxchhtht0vgwp2wnd openwall.com: http://www.openwall.com/lists/oss-security/2026/02/24/4

Credits

🔍 Saif Salah Daniel Gaspar