CVE-2026-23980

Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

Affected products

Apache Superset

Apache Superset

< 6.0.0

Fix

Available

CVSS 3.1

6.5 MEDIUM

EPSS

0.6% (47th percentile)

Weakness

CWE-89

NVD status

Analyzed

Published

2026-02-24