CVE-2018-8021: Apache Superset pickle deserialization remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

critical priorityCVSS 9.8 with network, unauthenticated, no-interaction exploitation, public exploit code and a high EPSS score make this a critical pre-auth RCE for unpatched Superset deployments.

What it is

Apache Superset versions prior to 0.23 deserialized data with an unsafe pickle load method, allowing untrusted serialized data to be executed as code. Because the flaw is reachable over the network without credentials, it exposes pre-0.23 deployments to full remote code execution.

Impact

An attacker can execute arbitrary code on the Superset server, leading to complete compromise of confidentiality, integrity and availability of the host and its data.

Attack surface

The CVSS vector is network-reachable with no privileges and no user interaction, so the vulnerable deserialization path can be hit directly by an unauthenticated remote request. The description does not specify the exact endpoint or parameter involved.

Exploitation

CVE-2018-8021 is not listed in CISA KEV, but an Exploit-DB entry exists and EPSS gives a 30-day probability of about 0.53 (98.9th percentile), indicating public exploit code and elevated likelihood of exploitation.

What to do

• Upgrade Superset to 0.23 or later, which replaced the unsafe pickle load method; note 0.23 predates the Apache Software Foundation releases.
• If immediate upgrade is not possible, restrict network access to the Superset web interface to trusted networks only.
• Search the codebase and any custom integrations for pickle.load or pickle.loads usage and replace with a safe serialization format.
• Monitor for and block requests attempting to submit serialized pickle payloads to Superset endpoints.
• Treat any pre-0.23 Superset instance as potentially compromised and review logs for unexpected process execution.

Detection

• Review Superset access logs for anomalous POST or GET requests to endpoints that handle serialized data, especially from unexpected source IPs.
• Monitor for child processes spawned by the Superset web service, such as shells or interpreters, which would indicate code execution.
• Alert on outbound network connections from the Superset host to unfamiliar destinations following web requests.
• Inventory deployed Superset versions and flag any instance running below 0.23.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.