SQL Injection in Apache Superset
CVE-2025-55674
A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue.
Vulnerability class: SQL Injection
EPSS: 0.007 (48.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 6.5 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Apache Superset
- Apache Software Foundation Superset — versions 0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@apache.org (vendor-advisory, Mailing List, Vendor Advisory)
- af854a3a-2127-422b-91ae-364da2661108
Frequently asked questions
- What is CVE-2025-55674?
- CVE-2025-55674 is a medium-severity vulnerability in Apache Superset, classified under SQL Injection. CVSS score: 6.5/10. Published 2025-08-14.
- How severe is CVE-2025-55674?
- Medium severity. CVSS v3 base score is 6.5 out of 10.
- Is CVE-2025-55674 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.