Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

apache/superset

              master @ 6f12d17
            

324

Fixes

CVEs

CRITICAL

Peak severity

27.3%

Coverage

Highlights

Auth Bypass: 186 prior fixes. Scrutinize any change in this area.

superset/security/manager.py: most-fixed (50 issues). Treat as high-risk during review.

158 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: A high volume of vulnerabilities occurred due to dynamic user context mutations (e.g., in background async query managers and MCP tools) where stale session contexts or missing validations allowed unauthenticated or low-privilege guest users to execute queries on unauthorized datasets. This frequently bypasses intended Row-Level Security (RLS) rules.

SQL Injection: Users with ad-hoc query capabilities (such as in SQL Lab) bypass security rules using custom SQL expressions or by exploiting vulnerabilities in the blocklist validator. Unsafe rendering of custom SQL metric functions can allow arbitrary reading of the backend database or unauthorized execution of database operations.

Cryptographic Issues: Deploying Superset with default cryptographic configurations (such as a hardcoded Flask SECRET_KEY or default global guest token JWT secrets) opens the system to critical session hijacking and arbitrary token forging. Several patches introduce startup-time assertion checks to force generation of strong, unique secrets in production.