Bypass of Security Feature in Apache Superset by Apache

CVE-2025-55674

What is CVE-2025-55674?

A vulnerability in Apache Superset allows attackers to bypass the DISALLOWED_SQL_FUNCTIONS security feature, enabling unauthorized execution of blocked SQL functions. This flaw can be exploited by users with SQL Lab access through a crafted inline block, ultimately leading to unauthorized access to sensitive database information, such as the software version. It is crucial for users of affected versions prior to 5.0.0 to upgrade promptly to mitigate the risk of data exposure.

References