N/A

CVSS Score

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-55674

CVE-2025-55674: Apache Superset has bypass of `DISALLOWED_SQL_FUNCTIONS` that allows execution of blocked SQL functions

A bypass of the DISALLOWED_SQL_FUNCTIONS security feature in Apache Superset allows for the execution of blocked SQL functions. An attacker can use a special inline block to circumvent the denylist. This allows a user with SQL Lab access to execute functions that were intended to be disabled, leading to the disclosure of sensitive database information like the software version.

This issue affects Apache Superset: before 5.0.0.

Users are recommended to upgrade to version 5.0.0, which fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-55674

CVE-2025-55674:

N/A

CVSS Score

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
apache-superset	pip	< 5.0.0	5.0.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the mechanism for detecting and blocking disallowed SQL functions in Apache Superset. The root cause is the use of the sqlparse library, which was found to be susceptible to bypass through the use of specially crafted comments in the SQL query. This would allow an attacker with SQL Lab access to execute functions that are on the denylist (DISALLOWED_SQL_FUNCTIONS).

The primary fix is in commit ce6d0d5963fd394d0082dea9921c72b2558a2788, which replaces the vulnerable sqlparse-based implementation with a more robust one using the sqlglot library. The vulnerable function superset.sql_parse.check_sql_functions_exist was modified to use the new secure implementation, and the underlying vulnerable methods ParsedQuery.check_functions_exist and ParsedQuery._check_functions_exist_in_token were removed.

Other related commits show a broader effort to replace sqlparse with sqlglot for other security checks as well, such as detecting DML statements. This indicates a systematic effort to improve the security of SQL parsing in the application.

For a security engineer, the key takeaway is that any user with SQL Lab access on a vulnerable version of Superset could bypass the configured function denylist, potentially leading to information disclosure or other security impacts depending on the disallowed functions. The identified vulnerable functions are central to this vulnerability and would be key indicators in a runtime profile during an exploitation attempt.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.