CVE-2026-23983
📋 TL;DR
Authenticated users in Apache Superset can exploit a disabled-by-default tagging feature to retrieve sensitive user data including password hashes and email addresses. This affects all Apache Superset installations before version 6.0.0 where users have authenticated access, even with low-privilege roles like Gamma.
💻 Affected Systems
- Apache Superset
📦 What is this software?
Superset by Apache
⚠️ Risk & Real-World Impact
Worst Case
Attackers could obtain password hashes for offline cracking, potentially compromising administrative accounts and gaining full control of the Superset instance.
Likely Case
Low-privilege authenticated users exfiltrate sensitive user data including email addresses and login statistics, enabling targeted phishing or credential reuse attacks.
If Mitigated
With TAGGING_SYSTEM disabled (default), the vulnerability is not exposed, limiting impact to misconfigured systems.
🎯 Exploit Status
Requires authenticated access but minimal technical skill to exploit via API calls.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.0.0
Vendor Advisory: https://lists.apache.org/thread/62mgbc5hc8026skp69kb6vqozj3pr5ww
Restart Required: Yes
Instructions:
1. Backup your Superset instance. 2. Upgrade to Apache Superset 6.0.0 or later using your package manager or installation method. 3. Restart the Superset service. 4. Verify the upgrade completed successfully.
🔧 Temporary Workarounds
Disable Tagging System
allSet TAGGING_SYSTEM to False in Superset configuration to disable the vulnerable endpoint
In superset_config.py: TAGGING_SYSTEM = False
🧯 If You Can't Patch
- Ensure TAGGING_SYSTEM is set to False in all configurations
- Restrict authenticated user access and implement strict role-based access controls
🔍 How to Verify
Check if Vulnerable:
Check if TAGGING_SYSTEM is enabled in configuration and version is below 6.0.0Check Version:
superset versionVerify Fix Applied:
Confirm version is 6.0.0+ and TAGGING_SYSTEM is False, then test API endpoint returns proper error📡 Detection & Monitoring
Log Indicators:
- Unusual API calls to /api/v1/tag/ endpoints
- Multiple requests for tag associations with user objects
Network Indicators:
- HTTP GET requests to tag API endpoints returning sensitive user data
SIEM Query:
source="apache_superset" AND (uri_path="/api/v1/tag/" OR uri_path CONTAINS "/tag/")