PoC Index

CVE-2023-27524

KEVCRITICAL 9.8EPSS 97.4%

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database.Add a strong SECRET_KEY to your `superset_config.py` file like:SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.

CVSS v3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v3.1
8.9 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS v3.1
8.9 HIGHCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L/E:H
EPSS
97.41% chance of exploitation in the next 30 days, 100th percentile
CISA KEV
added 2024-01-08
Nuclei
critical · CWE-1188
Published
2023-04-24
Updated
2025-10-21

Proof-of-concept exploits (19)

Nuclei templates (1)

Metasploit modules (1)

ExploitDB entries (1)

Vulhub environments (1)

Exploit collections (1)

References

Related