CVE-2025-55673: Apache Superset data query improperly discloses database schema information to low-privileged guest user

August 14, 2025 (updated November 10, 2025)

When a guest user accesses a chart in Apache Superset, the API response from the /chart/data endpoint includes a query field in its payload. This field contains the underlying query, which improperly discloses database schema information, such as table names, to the low-privileged guest user.

This issue affects Apache Superset: before 4.1.3.

Users are recommended to upgrade to version 4.1.3, which fixes the issue.

References

github.com/advisories/GHSA-9g5x-mm39-wg9r
github.com/apache/superset
lists.apache.org/thread/h2hw756wk4sj4z49blvzkr5fntl9hlf8
nvd.nist.gov/vuln/detail/CVE-2025-55673

Code Behaviors & Features

Detect and mitigate CVE-2025-55673 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →