CVE-2023-27524: Apache Superset: Session validation vulnerability when using provided default SECRET_KEY

Published Apr 24, 2023
·
Updated

Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRETKEY according to installation instructions.

Other sources

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRETKEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRETKEY config.

Affected Software

3 affected componentsFixes available
Apache Superset<=2.0.1
pip/apache-superset<2.1.0
2.1.0
Apache Superset

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade pip/apache-superset to a version that resolves this vulnerability.

    Fixed in 2.1.0
  2. Configuration

    Add a strong SECRET_KEY to your superset_config.py file, for example: SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>. Ensure the value is a unique, secure, randomly generated secret.

    Apache Superset (superset_config.py) SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>
  3. Configuration

    Alternatively set the SUPERSET_SECRET_KEY environment variable to a unique, secure, randomly generated secret (e.g., export SUPERSET_SECRET_KEY="<YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>") before starting Superset.

    Apache Superset (environment variable) SUPERSET_SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>

Event History

Apr 24, 2023
CVE Published
via MITRE·03:28 PM
Data Sourced
via MITRE·03:28 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·06:30 PM
Jan 8, 2024
Known Exploited
via CISA·12:00 AM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is CVE-2023-27524?

CVE-2023-27524 is a vulnerability in Apache Superset versions up to and including 2.0.1 that allows attackers to authenticate and access unauthorized resources if the default configured SECRET_KEY has not been altered.

2

What is the severity of CVE-2023-27524?

CVE-2023-27524 has a severity rating of critical with a score of 9.8 out of 10.

3

How does CVE-2023-27524 affect Apache Superset installations?

CVE-2023-27524 affects Apache Superset installations that have not altered the default configured SECRET_KEY according to installation instructions.

4

How can I fix CVE-2023-27524?

To fix CVE-2023-27524, upgrade to Apache Superset version 2.1.0 or later, as recommended by the vendor.

5

Where can I find more information about CVE-2023-27524?

You can find more information about CVE-2023-27524 on the NIST National Vulnerability Database (NVD) website and the Apache Superset mailing list.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203