CVE-2025-55673
📋 TL;DR
This vulnerability allows guest users in Apache Superset to access database schema information through the /chart/data endpoint. The API response improperly includes query details that reveal table names and other schema data to low-privileged users. This affects all Apache Superset installations before version 4.1.3.
💻 Affected Systems
- Apache Superset
📦 What is this software?
Superset by Apache
⚠️ Risk & Real-World Impact
Worst Case
Attackers could map the entire database schema, enabling targeted attacks on specific tables or preparing for more severe exploits like SQL injection.
Likely Case
Information disclosure that reveals database structure, potentially exposing sensitive table names or relationships that could aid in reconnaissance.
If Mitigated
Limited impact if guest access is disabled or proper network segmentation isolates the Superset instance.
🎯 Exploit Status
Requires guest user access to Superset and ability to interact with the /chart/data endpoint. No authentication bypass is involved.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.1.3
Vendor Advisory: https://lists.apache.org/thread/h2hw756wk4sj4z49blvzkr5fntl9hlf8
Restart Required: No
Instructions:
1. Backup your current Superset configuration and database. 2. Upgrade Apache Superset to version 4.1.3 or later using your package manager or installation method. 3. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Disable Guest Access
allRemove or restrict guest user permissions to prevent access to the vulnerable endpoint.
superset init
superset fab create-admin
Remove guest role permissions in Superset UI
Network Segmentation
allRestrict network access to the Superset instance to authorized users only.
🧯 If You Can't Patch
- Disable guest user functionality entirely in Superset configuration
- Implement network-level access controls to restrict who can reach the Superset instance
🔍 How to Verify
Check if Vulnerable:
Check if your Apache Superset version is below 4.1.3 and if guest users can access charts through the API.Check Version:
superset versionVerify Fix Applied:
After upgrading to 4.1.3+, verify that guest users no longer receive query details in /chart/data API responses.📡 Detection & Monitoring
Log Indicators:
- Multiple API calls to /chart/data endpoint from guest users
- Unusual access patterns to chart endpoints
Network Indicators:
- Increased traffic to /api/v1/chart/data endpoint
- API responses containing SQL query strings
SIEM Query:
source="apache-superset" AND path="/api/v1/chart/data" AND user_role="guest"