CVE-2023-27524: session flaw in Apache Superset

CVE-2023-27524 affects Apache Superset, the open-source data visualization and analytics platform. The flaw impacts all versions up to and including 2.0.1 that have not changed the default SECRET_KEY set during installation. An attacker can forge session cookies and authenticate as a legitimate user, gaining access to unauthorized resources and data without valid credentials.

The assigned CVSS score is 8.9, high tier, reflecting how easily a remote attacker can gain unauthorized access when the default configuration is left unchanged. NVD published the vulnerability on April 24, 2023. Installations that have already changed the SECRET_KEY are not exposed. It is not confirmed whether the vulnerability is being actively exploited in the wild. A GitHub signal dated October 29, 2026 describes CTF labs dedicated to analyzing real-world vulnerabilities, including this CVE: this indicates technical and educational interest, not necessarily exploitation in production.

Administrators should prioritize checking the superset_config.py file and verify that the SECRET_KEY is no longer the one automatically generated at installation. A unique, long, randomly generated key must be set via the configuration file or the SUPERSET_SECRET_KEY environment variable. After the change, invalidate all active sessions by forcing re-login and monitor access logs for anomalies predating the fix.