Medium
Apache Superset: Stack traces enabled by default
Type: advisorySources: OSV
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-39264
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 2 Nov 2026, 20:11 UTC · Revision 1
Source evidence
Apache Superset: Stack traces enabled by default
core-osv · Original sourcePublished 6 Sept 2023, 12:58 UTC
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.
osv:CVE-2023-39264
Complete source record
{
"id": "1590bbcda87e2cfe158358205622cb95f5ee847978f3402ac36fa30eeb9e8348",
"url": "https://osv.dev/vulnerability/CVE-2023-39264",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Apache Superset: Stack traces enabled by default",
"summary": "By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.",
"evidence": "osv:CVE-2023-39264",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2023-39264",
"aliases": [
"BIT-superset-2023-39264",
"CVE-2023-39264",
"GHSA-cpvx-2365-466c",
"PYSEC-2026-1172"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/apache/superset",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "2817aebd69dc7d199ec45d973a2079f35e5658b6"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"last_affected": "2.1.0"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"2.1.0rc3",
"2.1.0",
"2.1.0rc2",
"superset-helm-chart-0.8.6",
"superset-helm-chart-0.8.5",
"superset-helm-chart-0.8.4",
"superset-helm-chart-0.8.3",
"superset-helm-chart-0.8.2",
"superset-helm-chart-0.8.1",
"superset-helm-chart-0.8.0",
"superset-helm-chart-0.7.7",
"superset-helm-chart-0.7.6",
"superset-helm-chart-0.7.4",
"superset-helm-chart-0.7.3",
"superset-helm-chart-0.7.2",
"superset-helm-chart-0.7.1",
"superset-helm-chart-0.7.0",
"superset-helm-chart-0.6.6",
"superset-helm-chart-0.6.5",
"superset-helm-chart-0.6.4",
"superset-helm-chart-0.6.3",
"superset-helm-chart-0.6.2",
"superset-helm-chart-0.6.1",
"superset-helm-chart-0.6.0",
"superset-helm-chart-0.5.10",
"superset-helm-chart-0.5.9",
"superset-helm-chart-0.5.8",
"superset-helm-chart-0.5.7",
"superset-helm-chart-0.5.6",
"superset-helm-chart-0.5.5",
"superset-helm-chart-0.5.4",
"superset-helm-chart-0.5.3",
"superset-helm-chart-0.5.2",
"superset-helm-chart-0.5.1",
"superset-helm-chart-0.5.0",
"superset-helm-chart-0.4.0",
"superset-helm-chart-0.3.12",
"v2021.40.0",
"superset-helm-chart-0.3.11",
"v2021.41.0",
"superset-helm-chart-0.3.10",
"superset-helm-chart-0.3.9",
"v2021.38.0",
"v2021.36.5",
"superset-helm-chart-0.3.8",
"superset-helm-chart-0.3.7",
"v2021.36.0",
"v2021.35.0",
"v2021.34.0",
"superset-helm-chart-0.3.6",
"v2021.31.0",
"v2021.29.0",
"superset-helm-chart-0.3.5",
"v2021.27.1",
"v2021.27.0",
"superset-helm-chart-0.3.4",
"superset-helm-chart-0.3.3",
"superset-helm-chart-0.3.2",
"superset-helm-chart-0.3.1",
"superset-helm-chart-0.3.0",
"superset-helm-chart-0.2.1",
"superset-helm-chart-0.2.0",
"v2021.25.0",
"superset-helm-chart-0.1.6",
"superset-helm-chart-0.1.5",
"v2021.23.1",
"v2021.24.0",
"superset-helm-chart-0.1.4",
"v2021.23.0",
"v2021.21.0",
"v2021.22.0",
"superset-helm-chart-0.1.3",
"v2021.19.0",
"v2021.20.0",
"v2021.18.0",
"v2021.17.0",
"superset-helm-chart-0.1.2",
"v2021.15.0",
"superset-helm-chart-0.1.1",
"superset-helm-chart-0.1.0",
"v2021.13.0",
"v2021.10.0",
"v2021.9.4",
"v2021.8.0",
"v2021.9.0",
"v2021.7.0",
"v2021.6.0",
"v2021.5.1",
"v2021.5.0",
"v2021.3.0",
"2020.51.1",
"v2020.51.0",
"test_tag",
"0.29.0rc1",
"0.25-fork",
"0.20.1",
"0.19.1",
"0.18.5",
"0.18.4",
"0.18.3",
"0.18.2",
"0.17.6",
"0.17.5",
"0.17.4",
"0.17.3",
"0.17.2",
"0.17.1",
"airbnb_prod.0.15.5.0",
"0.17.0",
"0.16.1",
"0.16.0",
"airbnb_prod.0.15.4.2",
"airbnb_prod.0.15.4.1",
"0.15.4.1",
"0.15.4",
"0.15.3",
"0.15.1",
"airbnb_prod.0.15.0.1",
"0.15.0",
"airbnb_prod.0.13.0.3",
"airbnb_prod.0.13.0.2",
"airbnb_prod.0.13.0.1",
"0.14.1",
"airbnb_prod.0.13.0.0",
"airbnb_prod.0.12.1.0",
"airbnb_prod.0.12.0.1",
"0.13.2",
"0.13.1",
"0.12.0",
"airbnb_prod.0.11.0.6",
"airbnb_prod.0.11.0.5",
"airbnb_prod.0.11.0.4",
"airbnb_prod.0.11.0.3",
"dummy",
"airbnb_prod.0.11.0.2",
"airbnb_prod.0.11.0.1",
"0.11.0",
"airbnb_prod.0.10.0.2",
"0.10.0",
"0.9.1",
"0.9.0",
"0.8.9",
"0.8.8",
"0.8.7",
"0.8.6",
"0.8.5",
"0.8.4",
"0.8.3",
"0.8.0",
"0.7.0",
"0.6.1",
"0.6.0",
"0.5.3",
"0.5.2",
"0.5.1",
"rm",
"0.5.0",
"0.4.0",
"0.2.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-39264.json"
}
}
],
"modified": "2026-10-28T02:30:23.041449948Z",
"provider": "osv",
"references": [
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39264.json",
"https://lists.apache.org/thread/y65t1of7hb445n86o1vdzjct7rfwlx75",
"https://nvd.nist.gov/vuln/detail/CVE-2023-39264"
],
"provider_metadata": {
"cwe_ids": [
"CWE-209"
],
"cna_assigner": "apache",
"unresolved_ranges": [
{
"extracted_events": [
{
"range": [
{
"last_affected": "2.1.0"
}
],
"source": "AFFECTED_FIELD",
"strategy": "StandardRange"
}
]
}
],
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/39xxx/CVE-2023-39264.json"
}
},
"related_cves": [
{
"value": "CVE-2023-39264",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 489668,
"published_at": "2023-09-06T12:58:59.791+00:00"
}