ZeroDay Findings
Sign inSign up

Findings

CVE-2023-27524

Apache Superset Insecure Default Initialization of Resource Vulnerability

Published Apr 24, 2023 · updated Jun 16, 2026 · apache superset

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config. All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your file like: SECRET_KEY = Alternatively you can set it with environment variable.

Timeline

Detection, updates, and resolution for this record.

  1. Apr 24, 2023 · Catalog

    Detected

    Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config. All superset installations should

  2. Jan 8, 2024 · CISA KEV

    Known exploited

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  3. Jan 29, 2024 · CISA KEV

    Remediation due

    Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

  4. Jun 16, 2026 · Catalog

    Updated

    Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config. All superset installations should

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA due date Jan 29, 2024

Affected

  • cpe apache/supersetversion unspecified
  • vendor Apache Supersetversion unspecified

Sources

  • CISA KEVCVE-2023-27524

    Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.

    cisa.gov
  • CVE.orgCVE-2023-27524

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2023-27524

    30-day exploitation probability 97.4%

    first.org
  • Exploit Database51447

    Public archive entry. The exploit body is not stored here.

    exploit-db.com
  • Metasploit Modulesauxiliary_gather/apache_superset_cookie_sig_priv_esc

    Public module reference (normal). Module source is not copied into this catalog.

    rapid7.com
  • Metasploit Modulesexploit_linux/http/apache_superset_cookie_sig_rce

    Public module reference (good). Module source is not copied into this catalog.

    rapid7.com
  • NIST NVDCVE-2023-27524

    Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not af

    nvd.nist.gov

References