Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions (CVE-2024-39887)
Apache Superset versions before 4.0.2 contain an SQL Injection vulnerability due to improper authorization checks on certain PostgreSQL engine-specific functions. This allows attackers to bypass SQL authorization by exploiting functions such as version, query_to_xml, inet_server_addr, and inet_client_addr. The vulnerability is fixed in version 4.0.2 by introducing a configuration key to disallow these functions.
AI Analysis
Technical Summary
CVE-2024-39887 is an SQL Injection vulnerability in Apache Superset caused by insufficient validation of specific PostgreSQL engine functions within SQL commands. Attackers can bypass Superset's SQL authorization by leveraging these unchecked functions. The fix involves adding a configuration key, DISALLOWED_SQL_FUNCTIONS, which blocks usage of vulnerable PostgreSQL functions. The vulnerability affects versions prior to 4.0.2.
Potential Impact
Successful exploitation allows attackers to bypass SQL authorization controls in Apache Superset, potentially leading to unauthorized data access or manipulation via SQL Injection. The vulnerability is rated critical due to the nature of SQL Injection and the bypass of authorization mechanisms.
Mitigation Recommendations
Upgrade Apache Superset to version 4.0.2 or later, which includes the fix introducing the DISALLOWED_SQL_FUNCTIONS configuration to block dangerous PostgreSQL functions. Users can also customize this configuration to add additional disallowed functions for enhanced protection.
Apache Superset: Improper SQL authorisation, parse not checking for specific engine functions (CVE-2024-39887)
Description
Apache Superset versions before 4.0.2 contain an SQL Injection vulnerability due to improper authorization checks on certain PostgreSQL engine-specific functions. This allows attackers to bypass SQL authorization by exploiting functions such as version, query_to_xml, inet_server_addr, and inet_client_addr. The vulnerability is fixed in version 4.0.2 by introducing a configuration key to disallow these functions.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-39887 is an SQL Injection vulnerability in Apache Superset caused by insufficient validation of specific PostgreSQL engine functions within SQL commands. Attackers can bypass Superset's SQL authorization by leveraging these unchecked functions. The fix involves adding a configuration key, DISALLOWED_SQL_FUNCTIONS, which blocks usage of vulnerable PostgreSQL functions. The vulnerability affects versions prior to 4.0.2.
Potential Impact
Successful exploitation allows attackers to bypass SQL authorization controls in Apache Superset, potentially leading to unauthorized data access or manipulation via SQL Injection. The vulnerability is rated critical due to the nature of SQL Injection and the bypass of authorization mechanisms.
Mitigation Recommendations
Upgrade Apache Superset to version 4.0.2 or later, which includes the fix introducing the DISALLOWED_SQL_FUNCTIONS configuration to block dangerous PostgreSQL functions. Users can also customize this configuration to add additional disallowed functions for enhanced protection.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-superset-2024-39887
- Osv Schema Version
- 1.5.0
- Aliases
- ["CVE-2024-39887"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Critical
Threat ID: 6aa005bfacd9273b49ab5b8d
Added to database: 09/08/2026, 12:55:27 UTC
Last enriched: 09/08/2026, 13:15:41 UTC
Last updated: 09/10/2026, 19:36:48 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.