---
title: "Apache Superset CVE-2023-27524: Default SECRET_KEY Takeover"
url: https://erroneo.us/security/briefs/superset-cve-2023-27524-default-secret-key/
description: "Superset 2.0.1 and earlier with a default SECRET_KEY let anyone forge an admin session. 2.1 blocks it; check your key, rotate secrets, hunt admin activity."
type: security-brief
section: "Security Digest"
date_published: 2023-04-05
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2023-27524"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Apache Superset CVE-2023-27524: Default SECRET_KEY Takeover

**Verdict: Check exposure.** Not a code bug but a shipped default; the version number alone does not prove you are safe, so confirm every Superset instance uses its own random SECRET_KEY, and if one ran on a default key while reachable, treat it and its database credentials as compromised.

- **Who must act:** Anyone running Apache Superset whose SECRET_KEY is, or ever was, a published default, especially Docker Compose or Helm installs and any instance reachable from the internet.
- **Who can relax:** Teams that set a unique random SECRET_KEY from the start and run a current release; Superset 2.1.0 and later refuse to start with the main default key.
- **Affected:** Apache Superset up to and including 2.0.1 left on the default SECRET_KEY (CVE record); Any version still using a known default key from Docker Compose, Helm or documentation examples (Horizon3, September 2023)
- **Fixed:** Superset 2.1.0 (Apr 5, 2023) refuses to start with the default SECRET_KEY; The real fix is a unique random key, rotated with superset re-encrypt-secrets; Current stable release: 6.1.0 (May 13, 2026)
- **CVEs:** CVE-2023-27524
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. List every Superset instance and record its version and where its SECRET_KEY comes from (superset_config.py or SUPERSET_SECRET_KEY).
2. Compare the key against the published defaults and replace any default or guessable key with one from openssl rand -base64 42.
3. Rotate the key the supported way: set PREVIOUS_SECRET_KEY, then run superset re-encrypt-secrets so stored database passwords stay readable.
4. Upgrade to a current release; 2.1.1 and later also fix the post-login RCE paths Horizon3 described.
5. If an instance ran on a default key while reachable, rotate every database credential configured in it and review its admin users.
6. Take Superset off the public internet or put it behind SSO or a VPN.

### How to check if you are affected

- Run Horizon3's check script against each instance you own to see whether its session cookies are signed with a known default key.
- Review the Superset action log for database connections added or edited, data exports and unusual SQL Lab queries.
- Search web server logs for /api/v1/database requests and admin activity from unfamiliar IP addresses.
- Look for admin activity with no matching login, since a forged cookie skips the login form.

## What happened

Apache Superset, the open-source BI and dashboard tool built on Flask, signs its session cookies with a `SECRET_KEY`. Superset shipped with a fixed default key, and many deployments never changed it. Anyone who knows the key can forge a cookie that says "I am user 1," which is usually the first administrator. Horizon3.ai reported this to Apache on October 11, 2021, and followed up with new data on February 9, 2023. [Superset 2.1.0](https://github.com/apache/superset/releases/tag/2.1.0), released April 5, 2023, refuses to start with the default key. Apache [announced](https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk) CVE-2023-27524 on April 24 for versions up to and including 2.0.1. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2023-27524) scores it CVSS 3.1 8.9, and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-27524) scores it 9.8.

[Horizon3's write-up](https://www.horizon3.ai/attack-research/disclosures/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/) found that 2,124 of 3,176 internet-facing instances, about 67%, used one of four default keys. With admin access, an attacker can add database connections, run arbitrary SQL in SQL Lab and harvest stored credentials. Horizon3 found paths to remote code execution, which its [September 2023 follow-up](https://www.horizon3.ai/attack-research/disclosures/apache-superset-part-ii-rce-credential-harvesting-and-more/) described. That post also said the fix was incomplete: Docker Compose and Helm installs could still run with default keys, and about 54% of instances (2,076 of 3,842) still did.

CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27524) on January 8, 2024, ["based on evidence of active exploitation."](https://www.cisa.gov/news-events/alerts/2024/01/08/cisa-adds-six-known-exploited-vulnerabilities-catalog) CISA published no details. [SecurityWeek](https://www.securityweek.com/cisa-warns-of-apache-superset-vulnerability-exploitation/) and [The Hacker News](https://thehackernews.com/2024/01/cisa-flags-6-vulnerabilities-apple.html) both said the attacks were not described. As of Oct 23, 2026, the attackers and campaigns behind the listing have not been disclosed.

## Who is affected

Any Superset instance whose session cookies are signed with a published key. The CVE covers 2.0.1 and earlier. Newer versions are safe only if the key is your own. If a vulnerable instance was ever reachable, the database passwords it stores should be treated as exposed. The key also encrypts those credentials, and Horizon3 calls them reversible.

## Do you really need to act?

Most teams can confirm and move on, so the verdict is check exposure. This is a configuration problem, so a version number does not settle it. A Helm or Compose deployment copied from an old template can carry a default key on any release. Fixing it takes minutes, and a forged admin session reaches every database Superset connects to.

## What to do now

1. For each instance, find where the key is set: `grep -n SECRET_KEY superset_config.py`, or check the `SUPERSET_SECRET_KEY` environment variable in your Compose or Helm values.
2. Replace any default or guessable key with one from `openssl rand -base64 42`, as the [Superset docs](https://superset.apache.org/admin-docs/configuration/configuring-superset) recommend.
3. Rotate it the supported way: set the old value as `PREVIOUS_SECRET_KEY`, the new one as `SECRET_KEY`, then run `superset re-encrypt-secrets`.
4. Upgrade to a current release. The latest stable is [6.1.0](https://github.com/apache/superset/releases/tag/6.1.0). Release 2.1.1 and later also fix the post-login RCE paths.
5. If an instance ran on a default key while reachable, rotate every database credential configured in it and review its admin accounts.

## How to tell if you were hit

- Run Horizon3's [check script](https://github.com/horizon3ai/CVE-2023-27524) against your own instances: `python3 CVE-2023-27524.py -u https://superset.example.com`.
- Review Superset's action log for database connections added or changed, data exports and unusual SQL Lab queries, as Horizon3 advises.
- Search web logs for `/api/v1/database` calls and admin activity from unfamiliar IP addresses. A forged cookie skips the login form, so admin actions with no matching login are a red flag.

## Timeline

- Oct 11, 2021 — Horizon3 reports the default key to Apache.
- Apr 5, 2023 — Superset 2.1.0 refuses to start with the default key.
- Apr 24, 2023 — Apache announces CVE-2023-27524.
- Apr 25, 2023 — Horizon3 publishes its write-up and check script.
- Aug 29, 2023 — Superset 2.1.1 fixes the follow-on RCE bugs.
- Sep 6, 2023 — Horizon3 reports about 54% of instances still on default keys.
- Jan 8, 2024 — CISA adds the CVE to KEV.
- Jan 29, 2024 — Federal remediation deadline.

## Sources

1. [Apache Superset — CVE-2023-27524: Session validation vulnerability when using provided default SECRET_KEY](https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk)
2. [Apache Superset — Configuring Superset: SECRET_KEY and key rotation](https://superset.apache.org/admin-docs/configuration/configuring-superset)
3. [Apache Superset — Release 2.1.0](https://github.com/apache/superset/releases/tag/2.1.0)
4. [Apache Superset — Release 6.1.0](https://github.com/apache/superset/releases/tag/6.1.0)
5. [CVE record — CVE-2023-27524](https://www.cve.org/CVERecord?id=CVE-2023-27524)
6. [NVD — CVE-2023-27524](https://nvd.nist.gov/vuln/detail/CVE-2023-27524)
7. [CISA — Known Exploited Vulnerabilities: CVE-2023-27524](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-27524)
8. [CISA — CISA Adds Six Known Exploited Vulnerabilities to Catalog (Jan 8, 2024)](https://www.cisa.gov/news-events/alerts/2024/01/08/cisa-adds-six-known-exploited-vulnerabilities-catalog)
9. [Horizon3.ai — CVE-2023-27524: Insecure Default Configuration in Apache Superset Leads to Remote Code Execution](https://www.horizon3.ai/attack-research/disclosures/cve-2023-27524-insecure-default-configuration-in-apache-superset-leads-to-remote-code-execution/)
10. [Horizon3.ai — Apache Superset Part II: RCE, Credential Harvesting and More](https://www.horizon3.ai/attack-research/disclosures/apache-superset-part-ii-rce-credential-harvesting-and-more/)
11. [Horizon3.ai — CVE-2023-27524 check script](https://github.com/horizon3ai/CVE-2023-27524)
12. [SecurityWeek — CISA Warns of Apache Superset Vulnerability Exploitation](https://www.securityweek.com/cisa-warns-of-apache-superset-vulnerability-exploitation/)
13. [The Hacker News — CISA Flags 6 Vulnerabilities](https://thehackernews.com/2024/01/cisa-flags-6-vulnerabilities-apple.html)

---
Source page: https://erroneo.us/security/briefs/superset-cve-2023-27524-default-secret-key/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt