Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in
    Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the
    sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended
    to upgrade to version 6.0.0, which fixes the issue. (CVE-2026-23980)

ID	Name	Product	Family	Type	Severity
461457	Echo: apache-superset: security update to 6.0.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
461457	Echo: apache-superset: security update to 6.0.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
438007	SCA: security update for apache-superset (GHSA-gvxg-9hqx-f4rg)	Tenable Cloud Security	SCA Checks	Local	medium
438007	SCA: security update for apache-superset (GHSA-gvxg-9hqx-f4rg)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2026-23980

medium

Tenable Plugins

medium

medium

medium

medium