EXPLOIT/ALERT Back to feed

Apache Superset Insecure Default Initialization of Resource Vulnerability

Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.

Published 22 Sep 2026Updated 22 Sep 2026915 sources
CVSS 9.8 ✓ VERIFIED REFERENCE△ CISA KEV
Overview Sources History

What happened

Apache Superset contains an insecure default initialization of a resource vulnerability that allows an attacker to authenticate and access unauthorized resources on installations that have not altered the default configured SECRET_KEY according to installation instructions.

Affected versions

Superset: See original advisory Fixed: See vendor advisory.

Why it matters

This source correlation may provide earlier visibility while structured CVE metadata is still being updated.

Detection & mitigation

  • Review the original advisory and validate affected versions.
  • Apply vendor-provided updates or mitigations when available.

Public PoC references

RepositoryAuthorFirst seenReference
Exploit-DB 51447Apache Superset 2.0.0 - Authentication BypassMaanVader2023-05-23VerifiedSploitusExploit for CVE-2023-27524. CVSS 9.8.Sploitus index2026-09-22T16:55:44+00:00CandidatePoC-in-GitHub · horizon3ai/CVE-2023-27524Basic PoC for CVE-2023-27524: Insecure Default Configuration in Apache Superset★ 113horizon3ai2023-04-25CandidatePoC-in-GitHub · Okaytc/Superset_auth_bypass_checkApahce-Superset身份认证绕过漏洞(CVE-2023-27524)检测工具★ 11Okaytc2023-04-27CandidatePoC-in-GitHub · ZZ-SOCMAP/CVE-2023-27524Apache Superset Auth Bypass Vulnerability CVE-2023-27524.★ 3ZZ-SOCMAP2023-04-27CandidatePoC-in-GitHub · MaanVader/CVE-2023-27524-POCA POC for the all new CVE-2023-27524 which allows for authentication bypass and gaining access to the admin dashboard.★ 0MaanVader2023-05-04CandidatePoC-in-GitHub · Ap0dexMe0/CVE-2023-27524Perform With Apache-SuperSet Leaked Token [CSRF]★ 3Ap0dexMe02023-05-04CandidatePoC-in-GitHub · tardc/CVE-2023-27524Apache Superset Auth Bypass (CVE-2023-27524)★ 10tardc2023-05-08CandidatePoC-in-GitHub · necroteddy/CVE-2023-27524CVE-2023-27524★ 0necroteddy2023-08-30CandidatePoC-in-GitHub · jakabakos/CVE-2023-27524-Apache-Superset-Auth-Bypass-and-RCE★ 28jakabakos2023-09-08CandidatePoC-in-GitHub · CN016/Apache-Superset-SECRET_KEY-CVE-2023-27524-Apache Superset 默认SECRET_KEY 漏洞(CVE-2023-27524)★ 0CN0162023-10-10CandidatePoC-in-GitHub · h1n4mx0z/Research-CVE-2023-27524CVE-2023-27524★ 0h1n4mx0z2023-10-30CandidatePoC-in-GitHub · karthi-the-hacker/CVE-2023-27524Tool for finding CVE-2023-27524 (Apache Superset - Authentication Bypass)★ 1karthi-the-hacker2024-05-11CandidatePoC-in-GitHub · Cappricio-Securities/CVE-2023-27524Apache Superset - Authentication Bypass★ 2Cappricio-Securities2024-05-11CandidatePoC-in-GitHub · sumaiyafathima-code/CVE-2023-27524★ 0sumaiyafathima-code2026-03-15CandidatePoC-in-GitHub · rachidafaf/bola-CVE-2023-27524★ 0rachidafaf2026-04-05CandidatePoC-in-GitHub · CyberCTF/vulhub-superset-cve-2023-27524Vulhub superset/CVE-2023-27524: Apache Superset Default SECRET_KEY Session Forgery (CVE-2023-27524), run with Isoloom★ 0CyberCTF2026-10-08CandidateSploitusExploit for CVE-2023-27524. CVSS 9.8.Sploitus index2026-10-15T23:50:21+00:00Candidate
CorrectionsReport an issue