CVE-2023-27524
CriticalExploitedPublic exploitApache superset missing check for default SECRET_KEY
Published Apr 24, 2023 · Updated Sep 8, 2026 · Also known as BIT-superset-2023-27524, GHSA-5cx2-vq3h-x52c, PYSEC-2026-1161, TR-23-0250
Key Facts
Patch immediately- CVE-2023-27524 is a critical-severity vulnerability (CVSS 9.8 v3.1) affecting Superset (Apache), Apache Superset (pypi).
- It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jan 8, 2024. Public exploit code is available.
- EPSS estimates a 97% probability of exploitation in the next 30 days.
- Fixed versions are available, including Apache Superset 2.0.1, Apache Superset 2.1.0, Superset 2.0.2.
- Brandefense priority: patch immediately, because it is listed as exploited in the wild.
CVSS v3.1
9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS (30-day exploit likelihood)
97%
Higher than 99.9% of all scored CVEs
Exploited in the wild
Yes
4 catalog listings
Public exploit code
Available
Proof-of-concept or weaponized module
Get the full CVE-2023-27524 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.
All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your superset_config.py file like:
SECRET_KEY =
Alternatively you can set it with SUPERSET_SECRET_KEY environment variable.
Known-Exploited Catalog Listings
| Catalog | Added | Remediation due | Ransomware use |
|---|---|---|---|
| CISA KEV | Jan 8, 2024 | Jan 29, 2024 | Not reported |
| Industry KEV feed | Jan 8, 2024 | Jan 29, 2024 | Not reported |
| CIRCL KEV | Jan 8, 2024 | Jan 29, 2024 | Not reported |
| ENISA EUVD | Jan 8, 2024 | n/a | Not reported |
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected Products
4 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| SupersetApache | See advisory | 2.0.1 |
| Apache Supersetpypi | See advisory | 2.1.0 |
Patched Releases
Apache Superset
2.0.1, 2.1.0
Superset
2.0.2
Timeline
Publicly disclosed
Apr 24, 2023
Added to CISA KEV
Jan 8, 2024
Added to Industry KEV feed
Jan 8, 2024
Added to CIRCL KEV
Jan 8, 2024
Added to ENISA EUVD
Jan 8, 2024
Last updated
Sep 8, 2026
Weakness Type
- CWE-1188 Initialization of a Resource with an Insecure Default
References
- advisoryGHSA advisory
- advisoryhttps://github.com/CVEProject/cvelistV5/tree/main/cves/2023/27xxx/CVE-2023-27524.json
- advisoryhttps://nvd.nist.gov/vuln/detail/CVE-2023-27524
- advisoryhttps://sensorstechforum.com/cve-2023-27524-apache-superset/
- advisoryhttps://sensorstechforum.com/what-is-remote-code-execution/
FAQ
Common Questions.
Session Validation attacks in Apache Superset versions up to and including 2.0.1.
Affected: Superset (Apache); Apache Superset (pypi). The full list is in the CVE brief.
It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jan 8, 2024.
Yes. It was added on Jan 8, 2024 with a federal remediation due date of Jan 29, 2024.
Public exploit code is available.
Fixed versions are available, including Apache Superset 2.0.1, Apache Superset 2.1.0, Superset 2.0.2.
Brandefense priority: patch immediately, because it is listed as exploited in the wild.
Is CVE-2023-27524 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo