CVE-2023-39265: Apache Superset improper input validation allows SQLite connection registration

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityThe flaw is network-reachable without authentication and has a very high EPSS score, though CVSS is only medium and KEV does not list it.

What it is

Apache Superset up to and including 2.1.0 fails to properly validate database connection driver names, so an attacker can register SQLite connections using alternative driver names such as sqlite+pysqlite or via database imports. This permits unexpected file creation on the Superset webserver and, if Superset uses SQLite for its metadata database, can escalate to confidentiality and integrity impacts.

Impact

An attacker can cause files to be created on the Superset webserver and, where SQLite backs Superset metadata, may read or alter that metadata, affecting confidentiality and integrity.

Attack surface

Reachable over the network through the database connection or import functionality with no authentication or user interaction required per the CVSS vector (AV:N/AC:L/PR:N/UI:N). The description does not specify the exact endpoint or role needed.

Exploitation

Not listed in CISA KEV and no ransomware usage documented; EPSS is high at 0.86203 (99.7th percentile), and a Packet Storm reference is titled as remote code execution, though the record does not confirm active exploitation.

What to do

• Upgrade Apache Superset to a version later than 2.1.0 that fixes the driver-name validation issue.
• Restrict access to database connection creation and database import features to trusted administrators only.
• Avoid using SQLite as the Superset metadata database in production; use a hardened database backend instead.
• Monitor and restrict filesystem write permissions for the Superset service account to limit unexpected file creation.

Detection

• Review Superset audit or application logs for database connection registrations or imports using driver names containing sqlite or sqlite+pysqlite.
• Alert on unexpected file creation in Superset webserver directories, especially files tied to SQLite database paths.
• Monitor for unusual database import activity or new connection definitions created outside normal change windows.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.