CVE Watch—

CVE-2023-27524

Apache Superset Insecure Default Initialization of Resource Vulnerability

CVSS

—

No CVSS

EPSS

97.4%

p100

KEV

YES

Jan 8, 2024

Exploit Today

0-100

Published: — · Last modified: —

EPSS · 30d

97.4%EPSS · 30 days97.4%

2026-09-162026-10-14

KEV catalog record

Product

Apache / Superset

Vulnerability

Apache Superset Insecure Default Initialization of Resource Vulnerability

Added to KEV

Jan 8, 2024

Remediate by

Jan 29, 2024

Known ransomware use

Summary description

Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk; https://nvd.nist.gov/vuln/detail/CVE-2023-27524

Related CVEs

No related CVEs by CWE or product.