Apache Superset Open Redirect
Priority MEDIUM 63CWE-601Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-601.
Summary
Apache Superset up to and including 1.0.1 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.
Why it matters now
EPSS 0.64016 99th percentileScored 2026-11-07
Fix Fixed apache-superset (PyPI): 1.1.0
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Apache | Apache Superset | Apache Superset – 1.0.1 | — | No fix listed | CNA |
| — | superset (PyPI) | up to 0.34.0 | — | No fix listed | GHSA-pfwg-rxf4-97c3 |
| — | apache-superset (PyPI) | before 1.1.0 | 1.1.0 | Patch available | GHSA-pfwg-rxf4-97c3 |
- Apache Superset VendorApache Affected Apache Superset – 1.0.1 Fixed in — No fix listed CNA
- superset (PyPI) Vendor— Affected up to 0.34.0 Fixed in — No fix listed GHSA-pfwg-rxf4-97c3
- apache-superset (PyPI) Vendor— Affected before 1.1.0 Fixed in 1.1.0 Patch available GHSA-pfwg-rxf4-97c3
Remediation
- Fix · GHSA-pfwg-rxf4-97c3 apache-superset (PyPI) Fixed in 1.1.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-28125
- 2026-10-03 Alias added: GHSA-pfwg-rxf4-97c3
References
Advisory 4
Other 4
- https://github.com/apache/superset/commit/eb35b804acf4d84cb70d02743e04b8afebbee029
- https://github.com/apache/superset
- https://github.com/pypa/advisory-database/tree/main/vulns/apache-superset/PYSEC-2021-128.yaml
- https://lists.apache.org/thread.html/r89b5d0dd35c1adc9624b48d6247729c73b2641b32754226661368434@%3Cdev.superset.apache.org%3E
More Apache Superset vulnerabilities
- TI-2023-12249 Apache Superset: Session validation vulnerability when using provided default SECRET_KEY KEVCVSS 3.1CRITICAL 9.8
- TI-2018-05798 Deserialization of untrusted data in Superset CVSS 3.0CRITICAL 9.8
- TI-2023-21408 Apache Superset: Privilege escalation with default examples database CVSS 3.1HIGH 8.8
- TI-2023-20410 Apache Superset: Possible Unauthorized Registration of SQLite Database Connections CVSS 3.1MEDIUM 6.5
- TI-2021-09242 Apache Superset stored XSS on Dashboard markdown CVSS 3.1MEDIUM 5.4
- TI-2023-19373 Apache Superset: Metadata db write access can lead to remote code execution CVSS 3.1MEDIUM 6.6
Sources
- CVE-2021-28125 · CVE Program
- CVE-2021-28125 · NVD
- FIRST EPSS
- GHSA-pfwg-rxf4-97c3 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences