PYSEC-2026-3078

See a problem?
Import Source
https://github.com/pypa/advisory-database/blob/main/vulns/superset/PYSEC-2026-3078.yaml
JSON Data
https://api.osv.dev/v1/vulns/PYSEC-2026-3078
Aliases
Published
2026-07-09T16:49:33Z
Modified
2026-07-13T16:43:32Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Open Redirect in Apache Superset
Details

Apache Superset prior to 1.1.0 allowed for the creation of an external URL that could be malicious. By not checking user input for open redirects the URL shortener functionality would allow for a malicious user to create a short URL for a dashboard that could convince the user to click the link.

References

Affected packages

PyPI / superset

Package

Name
superset
View open source insights on deps.dev
Purl
pkg:pypi/superset

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Last Affected
0.34.0

Affected versions

0.*
0.13.2
0.14.0
0.14.1
0.15.0
0.15.1
0.15.3
0.15.4
0.17.0
0.17.1
0.17.2
0.17.3
0.17.4
0.17.5
0.17.6
0.18.0
0.18.2
0.18.3
0.18.4
0.18.5
0.19.0
0.19.1
0.20.0
0.20.1
0.20.2
0.20.3
0.20.4
0.20.5
0.20.6
0.21.0
0.21.1
0.22.0
0.22.1
0.23.0
0.23.1
0.23.2
0.23.3
0.24.0
0.25.0
0.25.1
0.25.2
0.25.3
0.25.4
0.25.5
0.25.6
0.26.0
0.26.2
0.26.3
0.27.0rc1
0.27.0
0.28.0
0.28.1
0.29.0rc6
0.29.0rc7
0.30.0
0.30.1

Database specific

source 
"https://github.com/pypa/advisory-database/blob/main/vulns/superset/PYSEC-2026-3078.yaml"