EUVD-2026-51187
GHSA-92hr-7q6h-w7c4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Superset with low-privilege account
-
DeliveryCraft SQL payload with pathological backslash sequence
-
ExploitSubmit POST request to /api/v1/chart/data
-
ExecutionTrigger catastrophic regex backtracking in SQL_REGEX
-
PersistExhaust CPU on Superset worker thread
-
ImpactDegrade or deny service for all concurrent users
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V2 - Validation and Business Logic Regex complexity limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires: (1) a valid authenticated session on the target Apache Superset instance - the attacker must hold at minimum a user account with permission to invoke chart data queries; (2) network access to the /api/v1/chart/data endpoint; and (3) a target running Superset version 1.5.0 through 5.0.0. The pathological payload is specifically a long sequence of backslashes or similar repeated characters submitted via the queries.extras.where parameter. Exploitation is strictly limited by the authentication requirement - unauthenticated or anonymous access is insufficient. The impact is confined to availability (CPU exhaustion, service degradation); no confidentiality or integrity impact is described. Environments with strong account provisioning controls, MFA, and rate limiting on API endpoints are materially harder to exploit. |
| Impact | No CVSS vector or EPSS score was provided in the source data, so risk metrics must be inferred from the description. The attack requires a valid authenticated session - the attacker must hold at minimum a low-privilege Superset account capable of submitting chart queries - which substantially narrows the threat model compared to unauthenticated network-reachable vulnerabilities. The technical impact is limited to availability (DoS of worker processes); there is no described confidentiality or integrity impact. The vulnerability is not listed in CISA KEV, no POC code has been identified, and the attack surface is bounded by the authentication gate. Practical risk is moderate: a rogue insider, compromised account, or guest analyst could degrade or deny service for all concurrent users, but this is not a critical-priority item in environments with strong authentication hygiene. Rate limiting on /api/v1/chart/data provides meaningful partial mitigation. |
| Exploit ScenarioDerived | An authenticated Superset analyst submits a chart data query via the /api/v1/chart/data API endpoint, embedding a long sequence of backslashes in the queries.extras.where parameter. The SQL_REGEX engine enters catastrophic backtracking on the crafted input, saturating a worker CPU for the duration of the request and potentially cascading to deny service for all concurrent dashboard and query users. No public exploit code has been identified at time of analysis, but the attack pattern is straightforward to reproduce by any authenticated user with basic knowledge of ReDoS input construction. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 30, 2026
Regular Expression Denial of Service in Apache Superset's SQL parser (sql_parse.py) allows authenticated attackers to exhaust CPU resources on Superset worker processes by submitting crafted inputs containing pathological character sequences to SQL-processing endpoints. Versions 1.5.0 through 5.0.0 are affected via a vulnerable SQL_REGEX pattern that exhibits catastrophic backtracking under adversarial input. No public exploit code or active exploitation has been identified at time of analysis; the authentication prerequisite meaningfully limits opportunistic attack surface.
RemediationAI
The primary remediation is to upgrade Apache Superset to version 6.0.0 or later, which resolves the vulnerable SQL_REGEX pattern in sql_parse.py; this is the only complete fix. If immediate upgrade is not feasible, two vendor-documented compensating controls are available: first, deploy WAF rules targeting the queries.extras.where parameter to detect and block requests containing excessively long sequences of backslashes or anomalous repeated patterns - note that aggressive WAF rules carry a false-positive risk against legitimate complex SQL queries and require tuning; second, apply strict rate limiting to the /api/v1/chart/data endpoint to reduce the throughput achievable by an attacker and cap the availability impact, though this does not prevent individual slow requests from tying up worker threads. Both workarounds are temporary mitigations that do not eliminate the underlying vulnerability. Advisory references: https://superset.apache.org and https://www.cve.org/CVERecord?id=CVE-2026-23985.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability resides in the sql_parse.py module within Apache Superset's integration with the sqlparse library. The SQL_REGEX regular expression pattern contains overlapping disjunctions that share a common outer quantifier - the canonical structure that produces catastrophic backtracking in backtracking-based NFA regex engines. When the engine encounters a pathological input (specifically long sequences of backslashes or similar repeated characters), backtracking complexity degrades to polynomial or exponential time, consuming a worker thread's CPU for the entire duration of the request. This is a textbook instance of CWE-1333 (Inefficient Regular Expression Complexity). No CPE strings were provided in the source data, but affected scope is clearly Apache Superset 1.5.0 through 5.0.0, with the fix committed in 6.0.0.
Know when Superset gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Network-accessible endpoint, low complexity, but requires an authenticated session (PR:L); impact is availability-only with no confidentiality or integrity loss.
Primary rating from Vendor (CNA).
CVSS VectorVendor
Lifecycle Timeline
3Description PRE-NVD
Executive ViewAI
Apache Superset (versions 1.5.0-5.0.0) contains a critical regular expression denial-of-service vulnerability in its SQL parser that authenticated users can exploit to crash platform worker processes. An attacker with valid credentials can submit malicious SQL queries to disable analytics functionality for all users, creating material business risk if user access controls are not restrictive. While public exploit code has not been identified, the authentication prerequisite means risk concentrates on internal threats or compromised accounts.
No vendor-released patch identified at time of analysis. Interim controls: enforce role-based access control limiting SQL submission to administrators; configure Superset query timeout settings to 5 seconds CPU maximum per query; deploy input validation blocking SQL strings exceeding 10KB or containing nested regex patterns; monitor worker process CPU and restart frequency for ReDoS indicators; implement query audit logging for forensic analysis if incidents occur.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Rated critical severity (CVSS 9.8), th
An SQL Injection vulnerability in Apache Superset exists due to improper neutralization of special elements used in SQL
Versions of Superset prior to 0.23 used an unsafe load method from the pickle library to deserialize data leading to pos
If an attacker gains write access to the Apache Superset metadata database, they could persist a specifically crafted Py
Apache Superset would allow for SQLite database connections to be incorrectly registered when an attacker uses alternati
Improper authorization check and possible privilege escalation on Apache Superset up to but excluding 2.1.2. Rated high
Apache Superset before 1.4.2 is vulnerable to SQL injection in chart data requests. Rated critical severity (CVSS 9.8),
A where_in JINJA macro allows users to specify a quote, which combined with a carefully crafted statement would allow fo
Apache Superset up to and including 1.3.0 when configured with ENABLE_TEMPLATE_PROCESSING on (disabled by default) allow
While investigating a bug report on Apache Superset, it was determined that an authenticated user could craft requests v
In the course of work on the open source project it was discovered that authenticated users running queries against Hive
Improper Authorization vulnerability in Apache Superset when FAB_ADD_SECURITY_API is enabled (disabled by default). Rate
Exploit-DB