PYSEC-2026-1172

vendorUSosv

Apache Superset may expose internal traces on REST API endpoints

view advisory published 2026-07-07Licence: CC-BY-4.0

By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset versions up to and including 2.1.0.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2023-39264US	medium4.3	1.13% (66th)	—	2023-09-06
By default, stack traces for errors were enabled, which resulted in the exposure of internal traces on REST API endpoints to users. This vulnerability exists in Apache Superset ver…

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-cpvx-2365-466cADVISORY
https://github.com/apache/supersetPACKAGE
https://lists.apache.org/thread/y65t1of7hb445n86o1vdzjct7rfwlx75WEB
https://nvd.nist.gov/vuln/detail/CVE-2023-39264ADVISORY
https://pypi.org/project/apache-supersetPACKAGE

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan