An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user
    with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection.
    While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT,
    UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements.
    This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which
    fixes the issue. (CVE-2026-23984)

ID	Name	Product	Family	Type	Severity
460351	Echo: apache-superset: security update to 6.0.0	Tenable Cloud Security	Echo Local Security Checks	Local	high
460351	Echo: apache-superset: security update to 6.0.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	high
438020	SCA: security update for apache-superset (GHSA-mwf2-qr4v-94h2)	Tenable Cloud Security	SCA Checks	Local	high
438020	SCA: security update for apache-superset (GHSA-mwf2-qr4v-94h2)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-23984

high

Tenable Plugins

high

high

high

high