Apache Superset Improper Input Validation Vulnerability in SQLLab PostgreSQL Read-Only Bypass

A vulnerability allowing improper input validation has been identified in Apache Superset versions prior to 6.0.0. This issue allows authenticated users with SQLLab access to bypass read-only verification checks on PostgreSQL database connections. While the system typically prevents standard Data Manipulation Language (DML) operations such as INSERT, UPDATE, and DELETE on read-only connections, it fails to recognize these actions within specially crafted SQL statements.

Impact

Exploitation of this vulnerability could lead to unauthorized data modifications on read-only PostgreSQL connections by bypassing standard DML restrictions.

Remediation

Users are advised to upgrade to Apache Superset version 6.0.0 or later, which addresses this vulnerability.