Apache Superset CVE-2023-27524: Default SECRET_KEY Takeover
Not a code bug but a shipped default; the version number alone does not prove you are safe, so confirm every Superset instance uses its own random SECRET_KEY, and if one ran on a default key while reachable, treat it and its database credentials as compromised.
Must act: Anyone running Apache Superset whose SECRET_KEY is, or ever was, a published default, especially Docker Compose or Helm installs and any instance reachable from the internet.
Can relax: Teams that set a unique random SECRET_KEY from the start and run a current release; Superset 2.1.0 and later refuse to start with the main default key.
- List every Superset instance and record its version and where its SECRET_KEY comes from (superset_config.py or SUPERSET_SECRET_KEY).
- Compare the key against the published defaults and replace any default or guessable key with one from openssl rand -base64 42.
- Rotate the key the supported way: set PREVIOUS_SECRET_KEY, then run superset re-encrypt-secrets so stored database passwords stay readable.