~ / search / GHSA-48m2-v2r8-h23m

GHSA-48m2-v2r8-h23m

Apache Superset: Incomplete DISALLOWED_SQL_FUNCTIONS default list for ClickHouse engine

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-23969

Packages

EcosystemPackageAffectedFixed in
PyPI apache-superset < 4.1.2 4.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue.

References

External links from the advisory. They lead to third-party sites.