Apache Superset Incomplete Function Filtering Vulnerability in ClickHouse Engine
Vulnerability
A vulnerability exists in Apache Superset versions prior to 4.1.2, where the default list of disallowed SQL functions for the ClickHouse engine was incomplete. This oversight allows the execution of potentially sensitive SQL functions in SQL Lab and charts, contrary to the application's intended restrictions.
Impact
Exploitation of this vulnerability could lead to the execution of sensitive SQL functions in ClickHouse, bypassing intended safeguards.
Remediation
Users are advised to upgrade to Apache Superset version 4.1.2 or later, which addresses this vulnerability.
Added: Feb 24, 2026, 3:02 PM
Updated: Feb 24, 2026, 11:04 PM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
2.5exploitability
4.8remediation
0.0relevance
3.1threat
0.0urgency
2.9incentive
0.0Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.