CVE-2023-37941 json
Apache Superset: Metadata db write access can lead to remote code execution
published 2023-09-06 3 y ago modified 2026-09-08 2 mo ago also BIT-superset-2023-37941 , EUVD-2023-2493 , GHSA-fj4x-m62j-wvwg , PYSEC-2026-1175
- cvss
- 6.6
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 35.5%
- EPSS 35.5% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Metasploit
Summary
If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Python object that may lead to remote code execution on Superset's web backend.
The Superset metadata db is an 'internal' component that is typically only accessible directly by the system administrator and the superset process itself. Gaining access to that database should be difficult and require significant privileges.
This vulnerability impacts Apache Superset versions 1.5.0 up to and including 2.1.0. Users are recommended to upgrade to version 2.1.1 or later.
Patch / fix
- pypi apache-superset 2.1.1
- bitnami superset 2.1.1
Timeline
- First public exploit (Metasploit exploit/linux/http/apache_superset_cookie_sig_rce)
- Published
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- total
- Assessed
- 2 y ago
Exploit prediction
35.45% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/linux/http/apache_superset_cookie_sig_rce Apache Superset Signed Cookie RCE metasploit exploit, good rank, 2023-09-06
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.6 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
| GitHub | 3.1 | 6.6 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 6.6 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
| OSV | 3.1 | 6.6 | CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | apache-superset | >=1.5.0, <2.1.1 |
2.1.1 |
| bitnami | superset | >=1.5.0, <2.1.1 |
2.1.1 |
Affected products
- Apache Software Foundation Apache Superset
- apache superset
Classification
- Weakness
-
- CWE-502 Deserialization of Untrusted Data
References
-
lists.apache.org
/thread/6qk1zscc06yogxxfgz2bh2bvz6vh9g7h
vendor-advisory, web, advisory
-
packetstormsecurity.com
/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html
web
-
nvd.nist.gov
/vuln/detail/CVE-2023-37941
advisory, web
-
github.com
/apache/superset
package
-
pypi.org
/project/apache-superset
package
-
github.com
/advisories/GHSA-fj4x-m62j-wvwg
advisory
Sources
- CVE List CVE-2023-37941
- GitHub Advisory GHSA-fj4x-m62j-wvwg
- NVD CVE-2023-37941
- OSV BIT-superset-2023-37941
- OSV PYSEC-2026-1175
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.