CVE-2023-27524

CriticalCVSS 9.8/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.

All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your `superset_config.py` file like:

SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>

Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-1188

Affected software

No affected versions have been published.

Timeline

Published
Apr 24, 2023
Last modified
Jun 17, 2026
Added to CISA KEV
Jan 8, 2024
NVD status
Analyzed

Related CVEs from 2023

CVE-2023-275254.3An authenticated user with Gamma role authorization could have access to metadata information using non trivial methods in Apache Superset uCVE-2023-275264.3A non Admin authenticated user could incorrectly create resources using the import charts feature, on Apache Superset up to and including 2.CVE-2023-275277.5Shinseiyo Sogo Soft (7.9A) and earlier improperly restricts XML external entity references (XXE). By processing a specially crafted XML fileCVE-2023-275297.8Wacom Tablet Driver installer prior to 6.4.2-1 (for macOS) contains an improper link resolution before file access vulnerability. When a useCVE-2023-27535.4Cross-site Scripting (XSS) - Stored in GitHub repository thorsten/phpmyfaq prior to 3.2.0-beta.CVE-2023-275307.5A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could alCVE-2023-275315.3There is a deserialization of untrusted data vulnerability in the Kredis JSON deserialization codeCVE-2023-275327.5Vulnerability in Veeam Backup & Replication component allows encrypted credentials stored in the configuration database to be obtained. ThisCVE-2023-275338.8A vulnerability in input validation exists in curl <8.0 during communication using the TELNET protocol may allow an attacker to pass on maliCVE-2023-275348.8A path traversal vulnerability exists in curl <8.0.0 SFTP implementation causes the tilde (~) character to be wrongly replaced when used as CVE-2023-275355.9An authentication bypass vulnerability exists in libcurl <8.0.0 in the FTP connection reuse feature that can result in wrong credentials beiCVE-2023-275365.9An authentication bypass vulnerability exists libcurl <8.0.0 in the connection reuse feature which can reuse previously established connecti