# CVE-2023-27524: Apache Superset: Session validation vulnerability when using provided default SECRET_KEY > CVE-2023-27524: Apache Superset: Session validation vulnerability when using provided default SECRET_KEY. CVSS 8.9 (CVSS 3.1), in CISA KEV. Canonical: https://rewindex.com/cve/CVE-2023-27524 Last updated: 2025-10-21T23:05:48Z - Published: 2023-04-24 15:28 UTC · Updated: 2025-10-21 23:05 UTC · Assigner: apache - CVSS: 8.9 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L - EPSS: 98.1%, 100th percentile (scored 2026-10-25) - CISA KEV: yes, added 2024-01-08, federal due date 2024-01-29, ransomware use: Unknown - CWE: CWE-1188 ## Description Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET\_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET\_KEY config. All superset installations should always set a unique secure random SECRET\_KEY. Your SECRET\_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET\_KEY to your \`superset\_config.py\` file like: SECRET\_KEY = \ Alternatively you can set it with \`SUPERSET\_SECRET\_KEY\` environment variable. ## CISA required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. ## Affected vendors and products - Apache Software Foundation: Apache Superset ## References - [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2023-27524) - [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2023-27524) - [https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk](https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk) - [https://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.html](https://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.html) - [https://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html](https://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html) - [https://www.openwall.com/lists/oss-security/2023/04/24/2](https://www.openwall.com/lists/oss-security/2023/04/24/2) --- _Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_ --- Canonical: https://rewindex.com/cve/CVE-2023-27524 · Markdown: https://rewindex.com/cve/CVE-2023-27524.md · JSON: https://rewindex.com/api/v1/cves/CVE-2023-27524 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T03:13:38.885Z