Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions (CVE-2024-53947)
Apache Superset versions prior to 4.1.1 contain an SQL injection vulnerability due to improper authorization checks on certain PostgreSQL functions. This vulnerability allows attackers to bypass SQL authorization by exploiting engine-specific functions not properly disallowed. The issue is addressed in version 4.1.1 by adding additional PostgreSQL functions to the disallowed list.
AI Analysis
Technical Summary
CVE-2024-53947 is an SQL injection vulnerability in Apache Superset caused by insufficient filtering of specific PostgreSQL functions (query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema) in the SQL authorization process. This flaw allows attackers to bypass Superset's SQL authorization controls. It is a follow-up to CVE-2024-39887 with expanded coverage of disallowed functions. The vulnerability affects all Apache Superset versions before 4.1.1. The recommended remediation is to upgrade to version 4.1.1 or configure the DISALLOWED_SQL_FUNCTIONS setting to include the newly identified functions.
Potential Impact
Attackers can bypass Apache Superset's SQL authorization checks by exploiting unfiltered PostgreSQL functions, potentially allowing unauthorized SQL command execution. The severity is rated low, indicating limited impact or exploitability based on current information.
Mitigation Recommendations
Upgrade Apache Superset to version 4.1.1 or later, which includes the fix for this vulnerability. Alternatively, users can manually add the PostgreSQL functions query_to_xml_and_xmlschema, table_to_xml, and table_to_xml_and_xmlschema to the DISALLOWED_SQL_FUNCTIONS configuration setting to mitigate the issue.
Apache Superset: Improper SQL authorisation, parse not checking for specific postgres functions (CVE-2024-53947)
Description
Apache Superset versions prior to 4.1.1 contain an SQL injection vulnerability due to improper authorization checks on certain PostgreSQL functions. This vulnerability allows attackers to bypass SQL authorization by exploiting engine-specific functions not properly disallowed. The issue is addressed in version 4.1.1 by adding additional PostgreSQL functions to the disallowed list.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-53947 is an SQL injection vulnerability in Apache Superset caused by insufficient filtering of specific PostgreSQL functions (query_to_xml_and_xmlschema, table_to_xml, table_to_xml_and_xmlschema) in the SQL authorization process. This flaw allows attackers to bypass Superset's SQL authorization controls. It is a follow-up to CVE-2024-39887 with expanded coverage of disallowed functions. The vulnerability affects all Apache Superset versions before 4.1.1. The recommended remediation is to upgrade to version 4.1.1 or configure the DISALLOWED_SQL_FUNCTIONS setting to include the newly identified functions.
Potential Impact
Attackers can bypass Apache Superset's SQL authorization checks by exploiting unfiltered PostgreSQL functions, potentially allowing unauthorized SQL command execution. The severity is rated low, indicating limited impact or exploitability based on current information.
Mitigation Recommendations
Upgrade Apache Superset to version 4.1.1 or later, which includes the fix for this vulnerability. Alternatively, users can manually add the PostgreSQL functions query_to_xml_and_xmlschema, table_to_xml, and table_to_xml_and_xmlschema to the DISALLOWED_SQL_FUNCTIONS configuration setting to mitigate the issue.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- BIT-superset-2024-53947
- Osv Schema Version
- 1.6.2
- Aliases
- ["CVE-2024-53947"]
- Ecosystems
- ["Bitnami"]
- Database Specific Severity
- Low
Threat ID: 6aa005bfacd9273b49ab5b8b
Added to database: 09/08/2026, 12:55:27 UTC
Last enriched: 09/08/2026, 13:15:29 UTC
Last updated: 09/10/2026, 19:36:49 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.