Skip to content
Heist/ feed
Back to feed
Medium

Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions

Type: advisorySources: OSV

A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue.

Products
Not specified
Affected versions
Not specified
Fixed versions
Not specified
CVEs
CVE-2025-55674
Confirmed fixed CVEs
Not specified
Updated in this feed
3 Nov 2026, 01:25 UTC · Revision 1

Source evidence

Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions

core-osv · Original source

Published 14 Aug 2025, 13:18 UTC

A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue.

osv:CVE-2025-55674
Complete source record
{
  "id": "30e429b7974160274c96ef3979d78f7f0014b0e8bddc040c234c33728a7802a9",
  "url": "https://osv.dev/vulnerability/CVE-2025-55674",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions",
    "summary": "A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue.",
    "evidence": "osv:CVE-2025-55674",
    "products": [],
    "severity": "medium",
    "structured": {
      "id": "CVE-2025-55674",
      "aliases": [
        "BIT-superset-2025-55674",
        "CVE-2025-55674",
        "GHSA-fxgf-3xh6-m2pp",
        "PYSEC-2026-1178"
      ],
      "metrics": [
        {
          "type": "CVSS_V4",
          "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/apache/superset",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "fixed": "465e2a9631994892cf399d13dd926c56cecd58ca"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "fixed": "5.0.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  }
                ]
              }
            }
          ],
          "versions": [
            "5.0.0rc3",
            "5.0.0rc1",
            "superset-helm-chart-0.14.0",
            "superset-helm-chart-0.13.6",
            "superset-helm-chart-0.13.5",
            "superset-helm-chart-0.13.3",
            "superset-helm-chart-0.13.2",
            "superset-helm-chart-0.13.1",
            "superset-helm-chart-0.12.11",
            "superset-helm-chart-0.12.10",
            "superset-helm-chart-0.12.9",
            "superset-helm-chart-0.12.8",
            "superset-helm-chart-0.12.7",
            "superset-helm-chart-0.12.6",
            "superset-helm-chart-0.12.5",
            "superset-helm-chart-0.12.4",
            "superset-helm-chart-0.12.3",
            "superset-helm-chart-0.12.2",
            "superset-helm-chart-0.12.1",
            "superset-helm-chart-0.12.0",
            "superset-helm-chart-0.11.2",
            "superset-helm-chart-0.11.1",
            "superset-helm-chart-0.11.0",
            "superset-helm-chart-0.10.15",
            "superset-helm-chart-0.10.14",
            "superset-helm-chart-0.10.13",
            "superset-helm-chart-0.10.12",
            "superset-helm-chart-0.10.11",
            "superset-helm-chart-0.10.10",
            "superset-helm-chart-0.10.9",
            "superset-helm-chart-0.10.8",
            "superset-helm-chart-0.10.7",
            "superset-helm-chart-0.10.6",
            "superset-helm-chart-0.10.5",
            "superset-helm-chart-0.10.4",
            "superset-helm-chart-0.10.3",
            "superset-helm-chart-0.10.2",
            "superset-helm-chart-0.10.1",
            "superset-helm-chart-0.10.0",
            "superset-helm-chart-0.9.4",
            "superset-helm-chart-0.9.3",
            "superset-helm-chart-0.9.2",
            "superset-helm-chart-0.9.1",
            "superset-helm-chart-0.9.0",
            "superset-helm-chart-0.8.10",
            "superset-helm-chart-0.8.9",
            "superset-helm-chart-0.8.8",
            "superset-helm-chart-0.8.7",
            "superset-helm-chart-0.8.6",
            "superset-helm-chart-0.8.5",
            "superset-helm-chart-0.8.4",
            "superset-helm-chart-0.8.3",
            "superset-helm-chart-0.8.2",
            "superset-helm-chart-0.8.1",
            "superset-helm-chart-0.8.0",
            "superset-helm-chart-0.7.7",
            "superset-helm-chart-0.7.6",
            "superset-helm-chart-0.7.4",
            "superset-helm-chart-0.7.3",
            "superset-helm-chart-0.7.2",
            "superset-helm-chart-0.7.1",
            "superset-helm-chart-0.7.0",
            "superset-helm-chart-0.6.6",
            "superset-helm-chart-0.6.5",
            "superset-helm-chart-0.6.4",
            "superset-helm-chart-0.6.3",
            "superset-helm-chart-0.6.2",
            "superset-helm-chart-0.6.1",
            "superset-helm-chart-0.6.0",
            "superset-helm-chart-0.5.10",
            "superset-helm-chart-0.5.9",
            "superset-helm-chart-0.5.8",
            "superset-helm-chart-0.5.7",
            "superset-helm-chart-0.5.6",
            "superset-helm-chart-0.5.5",
            "superset-helm-chart-0.5.4",
            "superset-helm-chart-0.5.3",
            "superset-helm-chart-0.5.2",
            "superset-helm-chart-0.5.1",
            "superset-helm-chart-0.5.0",
            "superset-helm-chart-0.4.0",
            "superset-helm-chart-0.3.12",
            "v2021.40.0",
            "superset-helm-chart-0.3.11",
            "v2021.41.0",
            "superset-helm-chart-0.3.10",
            "superset-helm-chart-0.3.9",
            "v2021.38.0",
            "v2021.36.5",
            "superset-helm-chart-0.3.8",
            "superset-helm-chart-0.3.7",
            "v2021.36.0",
            "v2021.35.0",
            "v2021.34.0",
            "superset-helm-chart-0.3.6",
            "v2021.31.0",
            "v2021.29.0",
            "superset-helm-chart-0.3.5",
            "v2021.27.1",
            "v2021.27.0",
            "superset-helm-chart-0.3.4",
            "superset-helm-chart-0.3.3",
            "superset-helm-chart-0.3.2",
            "superset-helm-chart-0.3.1",
            "superset-helm-chart-0.3.0",
            "superset-helm-chart-0.2.1",
            "superset-helm-chart-0.2.0",
            "v2021.25.0",
            "superset-helm-chart-0.1.6",
            "superset-helm-chart-0.1.5",
            "v2021.23.1",
            "v2021.24.0",
            "superset-helm-chart-0.1.4",
            "v2021.23.0",
            "v2021.21.0",
            "v2021.22.0",
            "superset-helm-chart-0.1.3",
            "v2021.19.0",
            "v2021.20.0",
            "v2021.18.0",
            "v2021.17.0",
            "superset-helm-chart-0.1.2",
            "v2021.15.0",
            "superset-helm-chart-0.1.1",
            "superset-helm-chart-0.1.0",
            "v2021.13.0",
            "v2021.10.0",
            "v2021.9.4",
            "v2021.8.0",
            "v2021.9.0",
            "v2021.7.0",
            "v2021.6.0",
            "v2021.5.1",
            "v2021.5.0",
            "v2021.3.0",
            "2020.51.1",
            "v2020.51.0",
            "test_tag",
            "0.29.0rc1",
            "0.25-fork",
            "0.20.1",
            "0.19.1",
            "0.18.5",
            "0.18.4",
            "0.18.3",
            "0.18.2",
            "0.17.6",
            "0.17.5",
            "0.17.4",
            "0.17.3",
            "0.17.2",
            "0.17.1",
            "airbnb_prod.0.15.5.0",
            "0.17.0",
            "0.16.1",
            "0.16.0",
            "airbnb_prod.0.15.4.2",
            "airbnb_prod.0.15.4.1",
            "0.15.4.1",
            "0.15.4",
            "0.15.3",
            "0.15.1",
            "airbnb_prod.0.15.0.1",
            "0.15.0",
            "airbnb_prod.0.13.0.3",
            "airbnb_prod.0.13.0.2",
            "airbnb_prod.0.13.0.1",
            "0.14.1",
            "airbnb_prod.0.13.0.0",
            "airbnb_prod.0.12.1.0",
            "airbnb_prod.0.12.0.1",
            "0.13.2",
            "0.13.1",
            "0.12.0",
            "airbnb_prod.0.11.0.6",
            "airbnb_prod.0.11.0.5",
            "airbnb_prod.0.11.0.4",
            "airbnb_prod.0.11.0.3",
            "dummy",
            "airbnb_prod.0.11.0.2",
            "airbnb_prod.0.11.0.1",
            "0.11.0",
            "airbnb_prod.0.10.0.2",
            "0.10.0",
            "0.9.1",
            "0.9.0",
            "0.8.9",
            "0.8.8",
            "0.8.7",
            "0.8.6",
            "0.8.5",
            "0.8.4",
            "0.8.3",
            "0.8.0",
            "0.7.0",
            "0.6.1",
            "0.6.0",
            "0.5.3",
            "0.5.2",
            "0.5.1",
            "rm",
            "0.5.0",
            "0.4.0",
            "0.2.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-55674.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:24.944344354Z",
      "provider": "osv",
      "references": [
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55674.json",
        "https://lists.apache.org/thread/cn49ps15ny3g2b1qzdg5mj7hp47p5jdo",
        "https://nvd.nist.gov/vuln/detail/CVE-2025-55674"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-89"
        ],
        "cna_assigner": "apache",
        "unresolved_ranges": [
          {
            "extracted_events": [
              {
                "range": [
                  {
                    "fixed": "5.0.0"
                  }
                ],
                "source": "AFFECTED_FIELD",
                "strategy": "StandardRange"
              }
            ]
          }
        ],
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/55xxx/CVE-2025-55674.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2025-55674",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 491628,
  "published_at": "2025-08-14T13:18:10.535+00:00"
}