PyPI/apache-superset CVE-2026-23969: medium 6.5, EPSS 0.70%
Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine
Action: Upgrade apache-superset to 4.1.2 or later.
pip install apache-superset==4.1.2Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 4.1.2 | - |
Fixed versions
| 4.1.2 |
Sources
- osv: PYSEC-2026-2373
- nvd: CVE-2026-23969
- https://github.com/apache/superset
- https://lists.apache.org/thread/2q22sp4oj3krcgdkxchhtht0vgwp2wnd
- http://www.openwall.com/lists/oss-security/2026/02/24/4
- https://pypi.org/project/apache-superset
- https://github.com/advisories/GHSA-48m2-v2r8-h23m
CVE-2026-23969 · published · modified · JSON