Exposed Apache Superset Dashboard Put $110M in Loan Data at Risk
Summary
An unauthenticated Apache Superset dashboard at a financial institution’s vendor exposed sensitive lending data, including records for over 2.6 million allocated accounts and $110 million in outstanding loans.
Key points
- CloudSEK says it found a publicly accessible Apache Superset instance used by a vendor of a major financial institution.
- The dashboard was reportedly vulnerable to CVE-2023-27524 and used a default SECRET_KEY, with authentication controls missing.
- Exposed information included loan account numbers, borrower communication logs, lending workflows, and state-level loan allocation data.
- The article reports more than 2.6 million allocated accounts and over $110 million in outstanding loans.
- CloudSEK recommended upgrading Superset to version 2.0.1 or later, replacing the default SECRET_KEY, enforcing authentication, restricting access, and enabling logging.
Article Details
- Victim Organization
- Not disclosed; a vendor of a major financial institution was affected
- Incident Type
- Unauthenticated exposure of loan and financial data through a misconfigured Apache Superset dashboard vulnerable to CVE-2023-27524
- Data Types Exposed
- Loan account numbers
- Product types
- Bucket classifications
- Borrower communication logs and contact tracking
- Loan approval, rejection, and disbursement metrics
- State-wise loan distribution and debt allocation
- Outstanding loan information
- EMI summaries
- Co-lending and partner performance information
- Affected Records
- Over 2.6 million allocated accounts
- Affected Data Size
- Outstanding loans worth USD 110 million
- Operational Impact
- The dashboard exposed sensitive data and internal lending workflows. Loan servicing disruption, emergency patching, and audits are described as potential impacts, not confirmed outcomes.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
CVE
Vendors
Products
Apache Supersetour industry-leading digital supply chain monitoring platform, recently uncovered an unauthenticated Apache Superset dashboard belonging to a vendor of a major financial institution.SVigilWhat happens when sensitive financial dashboards are left wide open to the internet? CloudSEK’s SVigil, our industry-leading digital supply chain monitoring platform, recently uncovered an unauthenticated Apache