Apache Superset CVE-2023-27524 (default SECRET_KEY lets attackers forge session cookies and log in, CISA KEV): how do I check my Superset and rotate the key safely?

What it is: Apache Superset signs session cookies with SECRET_KEY. Installations that kept the default key shipped in the configuration (and copies of it from docs and examples) let anyone forge a valid session cookie and log in, often as an admin, then reach the connected databases. Apache disclosed it as CVE-2023-27524 in April 2023 for Superset up to 2.0.1; later releases refuse to start with the default key. CISA added it to the Known Exploited Vulnerabilities catalog in January 2024. Superset is often connected to production databases with broad credentials, which makes a takeover serious. Am I affected: - Superset 2.0.1 or earlier that never set its own SECRET_KEY (check superset_config.py and the SUPERSET_SECRET_KEY environment variable). Docker Compose or Helm deployments copied from examples often carry an example key, which is equally guessable. - Any version where the key is a published example or weak value is at risk, even if the exact CVE applies only to older releases. Fix: 1. Upgrade Superset to a current release. 2. Set a unique, random SECRET_KEY: in superset_config.py (SECRET_KEY = '<long random value>') or via the SUPERSET_SECRET_KEY environment variable; generate it with openssl rand -base64 42 and store it in your secrets manager, not in the repository. 3. Changing the key on an existing installation: the key also encrypts stored secrets (database connection passwords). Follow Superset's documented key rotation (set PREVIOUS_SECRET_KEY to the old value and run superset re-encrypt-secrets) so connections keep working. 4. Changing the key logs everyone out. If the instance ran with a default key and was reachable by others, assume it was accessed: review users and roles, saved queries and database connections, and rotate the credentials of every connected database. 5. Keep Superset behind SSO or a VPN rather than exposed directly. Verify: superset_config.py or the environment provides a non-default key, existing database connections still test successfully after re-encryption, and old session cookies no longer work. Sources: https://nvd.nist.gov/vuln/detail/CVE-2023-27524 https://lists.apache.org/thread/n0ftx60sllf527j7g11kmt24wvof8xyk https://superset.apache.org/docs/configuration/configuring-superset