Loading story…
Public proof-of-concept exploit code is available for CVE-2026-23980, an authenticated error-based SQL injection vulnerability affecting Apache Superset versions before 6.0.0. An attacker with read-level access can submit crafted sqlExpression and where parameter values to trigger database errors, potentially exposing backend query details, database structure, and sensitive metadata.
Apache remediated the issue in Superset 6.0.0; organizations should upgrade affected deployments promptly. Security teams should also review low-privilege Superset accounts and inspect application, proxy, and database logs for malformed requests involving the affected parameters and anomalous database-error activity, as public exploit availability is likely to increase probing of unpatched internet-exposed instances.
See real exploitation activity before you spend the cycle.
2 events from the most recent confirmed update back to the earliest known activity.
Apache disclosed CVE-2026-23980, an authenticated error-based SQL injection vulnerability affecting Apache Superset versions before 6.0.0, and remediated it in version 6.0.0. The flaw allows read-level users to manipulate the sqlExpression and where parameters to trigger database errors that may expose query and database metadata.
A public repository made a modified proof-of-concept exploit for CVE-2026-23980 available, including a Python exploit.py file. The sources state that public exploit availability lowers the effort needed to test exposed unpatched Superset instances.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Apache Syncope disclosed **CVE-2026-57308**, an important SQL injection vulnerability in the Audit Events search functionality that can let an authenticated administrator with sufficient entitlements execute arbitrary SQL through stacked queries. The issue is caused by improper neutralization of special elements in SQL commands, specifically unsanitized `sort` parameters handled by the application. The vulnerability affects Apache Syncope versions `3.0.0-M0` through `3.0.16`, `4.0.0-M0` through `4.0.6`, and `4.1.0-M0` through `4.1.1`. Apache advised users to upgrade to **4.0.7** or **4.1.2** to remediate the flaw, and credited **Lennart Hostettler** with reporting the issue.
Jul 20, 2026
Metabase disclosed and patched multiple critical vulnerabilities after a zero-day was exploited against **Metabase Cloud**, prompting urgent warnings for organizations running self-hosted instances. The flaws include two unauthenticated SQL injection issues, `CVE-2026-72898` and `CVE-2026-72899`, and a missing authorization vulnerability, `CVE-2026-72900`. According to the advisories, `CVE-2026-72898` can be abused through the `/reset_password` database endpoint to obtain administrator-level access, and both SQL injection bugs are reported as actively exploited. Metabase said its cloud service was patched for customers, while national cybersecurity authorities urged self-hosted users to update immediately. Affected releases earlier than **63.5, 62.9, 61.11, 60.17, 59.21, and 58.24** should be upgraded to those fixed versions or later across the supported `0.58.x` to `0.63.x` branches. The notices emphasize prompt remediation because the vulnerabilities allow remote, unauthenticated compromise of exposed Metabase deployments.
Aug 12, 2026
Apache released security updates for its Syncope identity and access management platform to fix multiple vulnerabilities across the 3.0, 4.0, and 4.1 branches, including remote code execution, SQL injection, privilege escalation, SSRF, information disclosure, XXE, XSS, and cryptographic weaknesses. The most severe issues include several Groovy-related post-authentication RCE flaws, while `CVE-2026-57308` affects Audit Events search through an unsanitized sort parameter that can enable authenticated SQL injection, and `CVE-2026-62183` can let a regular user elevate privileges through certain self-service workflow configurations and obtain administrator-level entitlements. Affected releases include Syncope 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.6, and 4.1.0-M0 through 4.1.1 for the newly disclosed SQL injection and privilege escalation bugs, with Apache delivering fixes in versions **4.0.7** and **4.1.2** and noting that some older flaws were addressed in earlier point releases such as **4.1.1**, **4.0.6**, **4.0.4**, **4.0.3**, **3.0.16**, and **3.0.15**. Apache said binary hotfixes are not available, requiring organizations to upgrade or rebuild from patched source, and urged administrators to review roles, entitlements, and self-service workflows; no public exploitation has been confirmed.
Jul 24, 2026