Vulnerability record · CVE-2023-27524 · published 24 April 2023
CVE-2023-27524: Apache Superset default SECRET_KEY allows session forgery and auth bypass
Apache · Superset
Apache Superset versions up to and including 2.0.1 ship with a default SECRET_KEY that, if left unchanged, lets an attacker forge signed session cookies and authenticate as any user. Because the key also encrypts sensitive database content, exposure extends beyond simple login bypass. Only installations that changed the default value are unaffected.
Description
Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config. All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database. Add a strong SECRET_KEY to your `superset_config.py` file like: SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY> Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityCVSS 9.8, CISA KEV listing and near-maximum EPSS with public exploit code make this an urgent, actively targeted flaw.
What it is
Apache Superset versions up to and including 2.0.1 ship with a default SECRET_KEY that, if left unchanged, lets an attacker forge signed session cookies and authenticate as any user. Because the key also encrypts sensitive database content, exposure extends beyond simple login bypass. Only installations that changed the default value are unaffected.
Impact
An unauthenticated attacker gains authenticated access to Superset and any resources reachable with the forged identity, and can potentially decrypt sensitive data protected by the same key. Reference material also links this flaw to remote code execution chains.
Attack surface
Reachable over the network with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N. The attacker only needs to know or guess the default SECRET_KEY to craft a valid session cookie.
Exploitation
Listed in CISA KEV with a due date of 2024-01-29, and EPSS shows a 30-day probability of roughly 0.97 at the 99.9th percentile. Public exploit references exist, including an authentication bypass and an RCE writeup.
What to do
- Upgrade Apache Superset past 2.0.1 to a release that does not ship a default SECRET_KEY.
- Set a unique, strong random SECRET_KEY in superset_config.py or via the SUPERSET_SECRET_KEY environment variable.
- Rotate the SECRET_KEY on any instance that may have run with the default, invalidating existing sessions.
- Audit Superset instances for unauthorized accounts, sessions or configuration changes made before remediation.
Detection
- Search Superset configuration and environment for the known default SECRET_KEY value.
- Review authentication logs for sessions or logins that do not correspond to legitimate user activity.
- Monitor for anomalous access to Superset admin endpoints or database connections following session creation.
- Alert on Superset instances running versions 2.0.1 or earlier that have not confirmed a custom SECRET_KEY.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Exploitation in the wild
CISA added CVE-2023-27524 to the Known Exploited Vulnerabilities catalog on 8 January 2024 as "Apache Superset Insecure Default Initialization of Resource Vulnerability". Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Federal deadline 29 January 2024.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk | Mailing ListVendor Advisory |
| https://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.html | ExploitThird Party AdvisoryVDB Entry |
| https://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html | ExploitThird Party AdvisoryVDB Entry |
| https://www.openwall.com/lists/oss-security/2023/04/24/2 | Mailing List |
| https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk | Mailing ListVendor Advisory |
| https://packetstormsecurity.com/files/172522/Apache-Superset-2.0.0-Authentication-Bypass.html | ExploitThird Party AdvisoryVDB Entry |
| https://packetstormsecurity.com/files/175094/Apache-Superset-2.0.0-Remote-Code-Execution.html | ExploitThird Party AdvisoryVDB Entry |
| https://www.openwall.com/lists/oss-security/2023/04/24/2 | Mailing List |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27524 | Third Party AdvisoryUS Government Resource |
Track CVE-2023-27524 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2023-27524), CISA KEV, FIRST EPSS (scores of 2026-09-24). This page is refreshed as NVD updates the record.
