CVE-2023-27524
Apache Superset: Session validation vulnerability when using provided default SECRET_KEY
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database.Add a strong SECRET_KEY to your `superset_config.py` file like:SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.
- Affected
- Apache Software Foundation · Apache Superset
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1 APACHE
- 8.9 HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L - CVSS v3.1 GitHub
- 8.9 HIGH
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L/E:H - EPSS
- 97.41% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2024-01-08
- Nuclei
- critical · CWE-1188
- Published
- 2023-04-24
- Updated
- 2025-10-21
Proof-of-concept exploits (19)
- https://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass…
- https://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution…
- CN016/Apache-Superset-SECRET_KEY-CVE-2023-27524-0★ · 2023-10-10
- Cappricio-Securities/CVE-2023-275242★ · 2024-06-24
- MaanVader/CVE-2023-27524-POC0★ · 2023-05-04
- NguyenCongHaiNam/Research-CVE-2023-275240★ · 2023-10-30
- Pari-Malam/CVE-2023-275243★ · 2023-07-24
- TardC/CVE-2023-2752410★ · 2023-05-09
- ThatNotEasy/CVE-2023-275243★ · 2023-07-24
- ZZ-SOCMAP/CVE-2023-275243★ · 2023-04-27
- antx-code/CVE-2023-275243★ · 2023-04-27
- h1n4mx0/Research-CVE-2023-275240★ · 2023-10-30
- horizon3ai/CVE-2023-27524113★ · 2023-09-09
- jakabakos/CVE-2023-27524-Apache-Superset-Auth-Bypass-and-RCE28★ · 2023-09-11
- karthi-the-hacker/CVE-2023-275241★ · 2024-05-11
- necroteddy/CVE-2023-275240★ · 2023-08-30
- summerainX/vul_poc1★ · 2024-06-19
- SamSothavy/Public-Exploit-Research0★ · 2026-06-26
- aadi0258/Apache-Superset-2.0.1-Exploit0★ · 2025-10-31
Nuclei templates (1)
Metasploit modules (2)
- rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/apache_superset_cooki…
- rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/apache_superset_cookie_s…
ExploitDB entries (1)
Vulhub environments (1)
Exploit collections (1)
- CVE-2023-27524.yamlzan8in/afrog
Security advisories
- https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27524
- advisories/GHSA-5cx2-vq3h-x52c