CVE-2023-27524

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.

All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your `superset_config.py` file like:

SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>

Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1188

Affected software

Vendor	Product	Versions
Apache Software Foundation	Apache Superset	<= 2.0.1

References

https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xykMailing List, Vendor Advisory
https://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
https://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://www.openwall.com/lists/oss-security/2023/04/24/2Mailing List
https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xykMailing List, Vendor Advisory
https://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.htmlExploit, Third Party Advisory, VDB Entry
https://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
https://www.openwall.com/lists/oss-security/2023/04/24/2Mailing List
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27524Third Party Advisory, US Government Resource

Timeline

Published: Apr 24, 2023
Last modified: Jun 17, 2026
Added to CISA KEV: Jan 8, 2024
NVD status: Analyzed

Related CVEs from 2023

CVE-2023-275254.3An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset u CVE-2023-275264.3A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.CVE-2023-275277.5Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML file CVE-2023-275297.8Wacom Tablet Driver installer prior to 6.4.2-1 (for macOS) contains an improper link resolution before file access vulnerability. When a use CVE-2023-27535.4Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.CVE-2023-275307.5A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could al CVE-2023-275315.3There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization code CVE-2023-275327.5Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. This CVE-2023-275338.8A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on mali CVE-2023-275348.8A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as CVE-2023-275355.9An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials bei CVE-2023-275365.9An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connecti