CVE-2023-27524
Apache Superset
Apache Superset Insecure Default Initialization of Resource Vulnerability
What it is
Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Vendor notices and references
Description and required action as published by CISA. Full record at NVD.
Other Apache entries on the list
- Struts Apache Struts Command Injection Vulnerability CVE-2016-3081 · Oct 8, 2026
- Tomcat Apache Tomcat Missing Encryption of Sensitive Data Vulnerability CVE-2026-34486 · Aug 4, 2026
- ActiveMQ Apache ActiveMQ Improper Input Validation Vulnerability CVE-2026-34197 · Apr 16, 2026
- HTTP Server Apache HTTP Server Improper Escaping of Output Vulnerability CVE-2024-38475 · May 1, 2025
- Tomcat Apache Tomcat Path Equivalence Vulnerability CVE-2025-24813 · Apr 1, 2025
- OFBiz Apache OFBiz Forced Browsing Vulnerability CVE-2024-45195 · Feb 4, 2025