---
id: "CVE-2023-27524"
kind: "vulnerability"
aliases: ["CVE-2023-27524"]
title: "Session Validation attacks in Apache Superset versions up to and including 2.0.1"
severity: "critical"
cvss: 9.8
epss: null
exploited: true
status: "open"
category: "package"
products: [{"name": "Apache Superset", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "apache superset", "fixed": [], "affected": "<= 2.0.1", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["apache-superset", "exploited", "package", "python", "self-hosted"]
not_affected_if: ["custom-secret-key", "managed-hosting"]
published_at: "2023-04-24T16:15:07+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27524", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27524", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# Session Validation attacks in Apache Superset versions up to and including 2.0.1

Apache Superset ships with a default SECRET_KEY in its install instructions, and installations that kept that default let an attacker forge valid sessions. The attacker can authenticate and reach resources they should not see.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Apache Superset affected ? fixed ?
- vendor:apache superset affected <= 2.0.1 fixed ?

## How to check

Check superset_config.py or the SUPERSET_SECRET_KEY environment variable and confirm it is not the documented default value.

## Fix

Set a unique, long random SECRET_KEY (or SUPERSET_SECRET_KEY) in the deployment config and restart Superset.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2023-27524
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2023-27524

## From the sources

Session Validation attacks in Apache Superset versions up to and including 2.0.1. Installations that have not altered the default configured SECRET_KEY according to installation instructions allow for an attacker to authenticate and access unauthorized resources. This does not affect Superset administrators who have changed the default value for SECRET_KEY config.

All superset installations should always set a unique secure random SECRET_KEY. Your SECRET_KEY is used to securely sign all session cookies and encrypting sensitive information on the database.
Add a strong SECRET_KEY to your `superset_config.py` file like:

SECRET_KEY = <YOUR_OWN_RANDOM_GENERATED_SECRET_KEY>

Alternatively you can set it with `SUPERSET_SECRET_KEY` environment variable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_