Apache Superset SQL Injection Vulnerability Bypassing Row Level Security

A SQL injection vulnerability has been identified in Apache Superset versions prior to 4.1.2. This issue allows authenticated malicious actors to bypass row level security configurations by injecting SQL into 'sqlExpression' fields. The injection of sub-queries can evade parsing defenses, ultimately leading to unauthorized access to data.

Impact

Exploitation of this vulnerability could result in improper authorization, allowing unauthorized access to data by bypassing row level security controls.

Remediation

Users are advised to upgrade to Apache Superset version 4.1.2 or later, which addresses this vulnerability.