Read the docs
TI-2024-22992 Aliases CVE-2024-34693GHSA-hcr7-cqwc-q5gq

Apache Superset: Server arbitrary file read

Priority LOW 33CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Improper Input Validation vulnerability in Apache Superset, allows for an authenticated attacker to create a MariaDB connection with local_infile enabled. If both the MariaDB server (off by default) and the local mysql client on the web server are set to allow for local infile, it's possible for the attacker to execute a specific MySQL/MariaDB SQL command that is able to read files from the server and insert their content on a MariaDB database table.This issue affects Apache Superset: before 3.1.3 and version 4.0.0 Users are recommended to upgrade to version 4.0.1 or 3.1.3, which fixes the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01584 75th percentileScored 2026-11-07
Fix Fixed Apache Superset (Apache Software Foundation): 3.1.3, 4.0.1apache-superset (PyPI): 3.1.3, 4.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
ApacheApache Supersetbefore 3.1.3; 4.0.0 to before 4.0.13.1.3, 4.0.1Patch availableCNA
—apache-superset (PyPI)before 3.1.33.1.3Patch availableGHSA-hcr7-cqwc-q5gq
—apache-superset (PyPI)4.0.0 to before 4.0.14.0.1Patch availableGHSA-hcr7-cqwc-q5gq
  • Apache Superset VendorApache Affected before 3.1.3; 4.0.0 to before 4.0.1 Fixed in 3.1.3, 4.0.1 Patch available CNA
  • apache-superset (PyPI) Vendor— Affected before 3.1.3 Fixed in 3.1.3 Patch available GHSA-hcr7-cqwc-q5gq
  • apache-superset (PyPI) Vendor— Affected 4.0.0 to before 4.0.1 Fixed in 4.0.1 Patch available GHSA-hcr7-cqwc-q5gq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:*before 3.1.3; 4.0.0 to before 4.0.1VulnerableApache
  • cpe:2.3:a:apache:superset:*:*:*:*:*:*:*:* Versions before 3.1.3; 4.0.0 to before 4.0.1 Vulnerable ·Apache

Remediation

  • Fix · CNA Apache Superset (Apache Software Foundation) Fixed in 3.1.3, 4.0.1
  • Fix · GHSA-hcr7-cqwc-q5gq apache-superset (PyPI) Fixed in 3.1.3 Advisory →
  • Fix · GHSA-hcr7-cqwc-q5gq apache-superset (PyPI) Fixed in 4.0.1 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-34693
  2. 2026-10-03 Alias added: GHSA-hcr7-cqwc-q5gq

References

Advisory 2

Other 2

  • TI-2023-12249 Apache Superset: Session validation vulnerability when using provided default SECRET_KEY KEVCVSS 3.1CRITICAL 9.8
  • TI-2018-05798 Deserialization of untrusted data in Superset CVSS 3.0CRITICAL 9.8
  • TI-2023-21408 Apache Superset: Privilege escalation with default examples database CVSS 3.1HIGH 8.8
  • TI-2023-20410 Apache Superset: Possible Unauthorized Registration of SQLite Database Connections CVSS 3.1MEDIUM 6.5
  • TI-2021-09242 Apache Superset stored XSS on Dashboard markdown CVSS 3.1MEDIUM 5.4
  • TI-2021-09359 Apache Superset Open Redirect CVSS 3.1MEDIUM 6.1
See all 69 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences