CyberSec.Space Logo
Back to CVE Browser

CVE-2025-55674

MEDIUM
5.3
CVSS Severity Score
EPSS Score0.0000%
EPSS Percentile0.00th
Published2025-08-14
Last Modified2026-06-17
Data SourcesNVD

Vulnerability Description

A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version. This issue affects Apache Superset: before 5.0.0. Users are recommended to upgrade to version 5.0.0, which fixes the issue.

Affected Platforms (CPE)

📦
Apache

Superset

< 5.0.0

References & Advisories

🔗 https://lists.apache.org/thread/cn49ps15ny3g2b1qzdg5mj7hp47p5jdo
🔗 http://www.openwall.com/lists/oss-security/2025/08/14/5

Related Vulnerabilities

CVE-2026-638078.8

In the Linux kernel, the following vulnerability has been resolved: KVM: x86/mmu: Ensure hugepage is in by slot before checking m...

CVE-2025-556755.3

Apache Superset contains an improper access control vulnerability in its /explore endpoint. A missing authorization check allows a...

CVE-2025-556735.3

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in it...

CVE-2025-556725.3

A stored Cross-Site Scripting (XSS) vulnerability exists in Apache Superset's chart visualization. An authenticated user with perm...