CVE-2026-23980

UNKNOWN 0.0

Apache Superset: Improper Neutralization of Special Elements used in a SQL Command

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

CWE	CWE-89
Vendor	apache software foundation
Product	apache superset
Published	Feb 24, 2026
Last Updated	Feb 24, 2026

Stay Ahead of the Next One

Get instant alerts for apache software foundation apache superset

Be the first to know when new unknown vulnerabilities affecting apache software foundation apache superset are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Apache Software Foundation / Apache Superset

0.0.0 < 6.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

lists.apache.org: https://lists.apache.org/thread/h4l02zw1pr2vywv0dc5zjn3grdcdhwf4 openwall.com: http://www.openwall.com/lists/oss-security/2026/02/24/5

Credits

Pritam Chakkerwar 🔍 Dhanush Nayak Pedro Sousa