CVE-2022-45438: Apache Superset

Medium severity, CVSS 5.3. EPSS: 1.2% chance of exploitation in the next 30 days.

When explicitly enabling the feature flag DASHBOARD_CACHE (disabled by default), the system allowed for an unauthenticated user to access dashboard configuration metadata using a REST API Get endpoint. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.

Affected products

• Apache Superset: up to and including 1.5.2; version 2.0.0 only

Published 2023-01-16. Last modified 2026-06-17.