CVE-2023-27524
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database.Add a strong SECRET_KEY to your `superset_config.py` file like:SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.
- CVSS v3.1
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1
- 8.9 HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L - CVSS v3.1
- 8.9 HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L/E:H - EPSS
- 97.41% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2024-01-08
- Nuclei
- critical · CWE-1188
- Published
- 2023-04-24
- Updated
- 2025-10-21
Proof-of-concept exploits (19)
- https://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.…
- https://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.…
- CN016/Apache-Superset-SECRET_KEY-CVE-2023-27524-0★ · 2023-10-10
- Cappricio-Securities/CVE-2023-275242★ · 2024-06-24
- MaanVader/CVE-2023-27524-POC0★ · 2023-05-04
- NguyenCongHaiNam/Research-CVE-2023-275240★ · 2023-10-30
- Pari-Malam/CVE-2023-275243★ · 2023-07-24
- TardC/CVE-2023-2752411★ · 2023-05-09
- ThatNotEasy/CVE-2023-275243★ · 2023-07-24
- ZZ-SOCMAP/CVE-2023-275243★ · 2023-04-27
- antx-code/CVE-2023-275243★ · 2023-04-27
- h1n4mx0/Research-CVE-2023-275240★ · 2023-10-30
- horizon3ai/CVE-2023-27524113★ · 2023-09-09
- jakabakos/CVE-2023-27524-Apache-Superset-Auth-Bypass-and-RCE28★ · 2023-09-11
- karthi-the-hacker/CVE-2023-275241★ · 2024-05-11
- necroteddy/CVE-2023-275240★ · 2023-08-30
- summerainX/vul_poc1★ · 2024-06-19
- SamSothavy/Public-Exploit-Research
- aadi0258/Apache-Superset-2.0.1-Exploit