Apache Superset Security Review

Apache Superset ships five built-in roles, Admin, Alpha, Gamma, Public and sql_lab, and Superset’s own documentation confirms Alpha users have access to all data sources by default, independently of any Row Level Security rule written for a narrower one.

Superset ships five built-in roles, and Row Level Security only reaches the ones a rule actually names

Superset’s security documentation sets out five built-in roles: Admin, who has all possible rights including granting or revoking access from other users; Alpha, who has access to all data sources but cannot grant or revoke access from others; Gamma, who can only see data sources they have been given access to through a complementary role; Public, the most restrictive role, built for anonymous dashboard viewers; and sql_lab, which grants SQL Lab access on top of whichever of the other roles a user already holds. Admin access to all databases is granted by default, while Alpha and Gamma both need database access assigned individually for SQL Lab. We map who actually holds each role against who the business meant to give broad, all-data-source access to, since granting Alpha to a reporting user hands them every connected data source, not just the ones their dashboards use.

Row Level Security in Superset runs through filters assigned to a dataset and a set of subjects, users, FAB groups or roles, and the documentation sets out two filter types: a Regular filter applies its clause only to the subjects it names, while a Base filter applies to everyone except the subjects named, making it the pattern for a deny-by-default baseline. Multiple filters on the same dataset are combined before the query runs, and Superset’s own worked example is explicit that filters sharing a group key are OR’d together while different group keys, including no group key at all, are AND’d, so a Finance filter and a Marketing filter on the same group key still let either team through, but an unrelated filter with its own group key narrows the result further. This is the same layer we review on our Tableau and Snowflake row-level security reviews, and we test whether every RLS rule’s group key and assigned subjects actually cover every role that can otherwise reach the dataset, Alpha’s default access included.

Embedding a dashboard for your own customers needs the EMBEDDED_SUPERSET feature flag enabled, and Superset’s embedding documentation and its REST API schema confirm the guest token your backend requests from /api/v1/security/guest_token/ carries a required resources array naming the dashboard, an optional user object, and a required rls array of clauses that scope what the embedded viewer sees, alongside a lifetime set by GUEST_TOKEN_JWT_EXP_SECONDS, five minutes by default. We test whether every guest token your application mints actually carries the rls clause it should for that customer, and whether the Allowed Domains list Superset checks against the request’s Referer header is configured tightly enough to stop a token being replayed from an origin it was never meant for.