CLEANSTART-2026-MV19484: filelock is a platform-independent file lock for Python

Q: Can this be exploited remotely?

No. The attack vector is local, so an attacker needs local access to the affected environment.

Q: What access does an attacker need before exploiting this issue?

The vulnerability requires low privileges and does not require user interaction.

Q: What is the potential impact if exploited?

The reported impact includes low confidentiality impact and high integrity impact. No availability impact is reported.

Published Nov 5, 2026

Updated

Security vulnerability affects the apache-superset package. filelock is a platform-independent file lock for Python.

Affected Software

1 affected componentFixes available

cleanstart/apache-superset<6.1.0-r8

6.1.0-r8

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/apache-superset to a version that resolves this vulnerability.
Fixed in 6.1.0-r8

Event History

Nov 5, 2026

Advisory Published

via OSV·12:36 AM

Data Sourced

via OSV·12:36 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-112909

Frequently Asked Questions

Can this be exploited remotely?

No. The attack vector is local, so an attacker needs local access to the affected environment.

What access does an attacker need before exploiting this issue?

The vulnerability requires low privileges and does not require user interaction.

What is the potential impact if exploited?

The reported impact includes low confidentiality impact and high integrity impact. No availability impact is reported.

CLEANSTART-2026-MV19484: filelock is a platform-independent file lock for Python

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Can this be exploited remotely?

What access does an attacker need before exploiting this issue?

What is the potential impact if exploited?

Company

Resources

Contact

Frequently Asked Questions

Can this be exploited remotely?

What access does an attacker need before exploiting this issue?

What is the potential impact if exploited?