Apache Superset before version 5.0.0 contains a vulnerability that allows bypassing the DISALLOWED_SQL_FUNCTIONS security feature. This bypass enables users with SQL Lab access to execute SQL functions that are intended to be blocked, potentially disclosing sensitive database information such as the software version. The issue is fixed in version 5.0.0.