Apache Superset default SECRET_KEY lets attackers forge admin cookie

CVE-2023-27524 in Apache Superset up to 2.0.1 lets an unauthenticated attacker forge an admin session cookie when the default SECRET_KEY is unchanged. ZoomEye counted 101,819 internet-facing Superset deployments; chained with CVE-2023-37941 and CVE-2024-28148, the flaws lead to code execution and authorization bypass.

• CVE-2023-27524 affects Superset up to and including 2.0.1
• ZoomEye: 101,819 Superset instances reachable online as of 2026-10-23
• CVE-2023-37941 pickle deserialization fixed in 2.1.1 enables RCE
• Rotating SECRET_KEY logs out all users, so the fix is often deferred