id: PYSEC-2026-1181
published: "2026-07-07T11:45:33.091102Z"
modified: "2026-07-07T17:23:45.494487Z"
aliases:
- CVE-2024-27315
- GHSA-h7r6-8qmm-hj5r
summary: "Apache Superset: Improper error handling on alerts"
details: "An authenticated user with privileges to create Alerts on Alerts & Reports has the capability to generate a specially crafted SQL statement that triggers an error on the database. This error is not properly handled by Apache Superset and may inadvertently surface in the error log of the Alert exposing possibly sensitive data.\n\nThis issue affects Apache Superset: before 3.0.4, from 3.1.0 before 3.1.1.\n\nUsers are recommended to upgrade to version 3.1.1 or 3.0.4, which fixes the issue.\n\n"
affected:
- package:
    name: apache-superset
    ecosystem: PyPI
    purl: pkg:pypi/apache-superset
  ranges:
  - type: ECOSYSTEM
    events:
    - introduced: "0"
    - fixed: 3.0.4
    - introduced: 3.1.0
    - fixed: 3.1.1
  versions:
  - 0.34.0
  - 0.34.1
  - 0.35.1
  - 0.35.2
  - 0.36.0
  - 0.37.0
  - 0.37.1
  - 0.37.2
  - 0.38.0
  - 0.38.1
  - 1.0.0
  - 1.0.1
  - 1.1.0
  - 1.2.0
  - 1.3.0
  - 1.3.1
  - 1.3.2
  - 1.4.0
  - 1.4.1
  - 1.4.2
  - 1.5.0
  - 1.5.1
  - 1.5.2
  - 1.5.3
  - 2.0.0
  - 2.0.1
  - 2.1.0
  - 2.1.1
  - 2.1.1rc1
  - 2.1.1rc2
  - 2.1.1rc3
  - 2.1.2
  - 2.1.3
  - 3.0.0
  - 3.0.0rc1
  - 3.0.0rc2
  - 3.0.0rc3
  - 3.0.0rc4
  - 3.0.1
  - 3.0.2
  - 3.0.3
  - 3.1.0
references:
- type: ADVISORY
  url: https://nvd.nist.gov/vuln/detail/CVE-2024-27315
- type: PACKAGE
  url: https://github.com/apache/superset
- type: WEB
  url: https://lists.apache.org/thread/qcwbx7q2s3ynsd405895bx3wcwq32j7z
- type: WEB
  url: http://www.openwall.com/lists/oss-security/2024/02/28/3
- type: PACKAGE
  url: https://pypi.org/project/apache-superset
- type: ADVISORY
  url: https://github.com/advisories/GHSA-h7r6-8qmm-hj5r
severity:
- type: CVSS_V3
  score: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
- type: CVSS_V4
  score: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N