CVE-2026-23969: Apache Superset: Exposure of Sensitive Information via Incomplete ClickHouse Function Filtering
Apache Superset utilizes a configurable dictionary, DISALLOWEDSQLFUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete.
This issue affects Apache Superset: before 4.1.2.
Users are recommended to upgrade to version 4.1.2, which fixes the issue.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23969?
The severity of CVE-2026-23969 is not specified, but it involves exposure of sensitive information due to incomplete SQL function filtering.
How do I fix CVE-2026-23969?
To fix CVE-2026-23969, ensure that the DISALLOWED_SQL_FUNCTIONS dictionary is properly configured to restrict sensitive SQL functions.
Which version of Apache Superset is affected by CVE-2026-23969?
CVE-2026-23969 affects Apache Superset versions up to but not including 4.1.2.
What type of vulnerability is CVE-2026-23969?
CVE-2026-23969 is a vulnerability that involves the exposure of sensitive information due to configuration issues in SQL function filtering.
Is CVE-2026-23969 related to SQL injection?
CVE-2026-23969 is not a direct SQL injection vulnerability but it can lead to exposure of sensitive data if SQL functions are improperly filtered.