CVE-2026-23980: Apache Superset: Improper Neutralization of Special Elements used in a SQL Command

Q: What is the severity of CVE-2026-23980?

CVE-2026-23980 has a high severity rating due to its potential for SQL injection attacks.

Q: How do I fix CVE-2026-23980?

To fix CVE-2026-23980, upgrade Apache Superset to version 6.0.0 or later.

Q: Who is affected by CVE-2026-23980?

CVE-2026-23980 affects authenticated users of Apache Superset versions prior to 6.0.0.

Q: What type of vulnerability is CVE-2026-23980?

CVE-2026-23980 is classified as an SQL Injection vulnerability.

Q: Can CVE-2026-23980 be exploited remotely?

CVE-2026-23980 requires authentication, thus it can only be exploited by authenticated users.

Published Feb 24, 2026

Updated

Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters.

This issue affects Apache Superset: before 6.0.0.

Users are recommended to upgrade to version 6.0.0, which fixes the issue.

Affected Software

2 affected components

Apache Superset<6.0.0

Event History

Feb 24, 2026

CVE Published

via MITRE·12:54 PM

Data Sourced

via MITRE·12:54 PM

DescriptionWeakness

Data Sourced

via NVD·02:16 PM

DescriptionSeverityWeaknessAffected Software

Jun 25, 58123

Event

via NVD·01:36 AM

Frequently Asked Questions

What is the severity of CVE-2026-23980?

CVE-2026-23980 has a high severity rating due to its potential for SQL injection attacks.

How do I fix CVE-2026-23980?

To fix CVE-2026-23980, upgrade Apache Superset to version 6.0.0 or later.

Who is affected by CVE-2026-23980?

CVE-2026-23980 affects authenticated users of Apache Superset versions prior to 6.0.0.

What type of vulnerability is CVE-2026-23980?

CVE-2026-23980 is classified as an SQL Injection vulnerability.

Can CVE-2026-23980 be exploited remotely?