Which versions of DataEase are affected by CVE-2026-40899?

DataEase open-source analytics platform (versions 2.10.20 and below) contains an arbitrary file read vulnerability that allows exfiltration of sensitive server data through malicious datasource…. A patch is available.

How to fix or mitigate CVE-2026-40899?

Within 24 hours, audit all DataEase deployments to identify instances running version 2.10.20 or earlier and assess which systems access sensitive data or credentials. Within 7 days, apply the vendor-released patch to all affected DataEase installations, verifying successful upgrade through version confirmation in the application interface. Within 30 days, complete a post-patch inventory audit to ensure no unpatched instances remain and review access logs for any suspicious datasource configuration changes during the vulnerability window.

DataEase CVE-2026-40899

Q: What is the CVSS score of CVE-2026-40899?

CVE-2026-40899 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

EUVD-2026-23293 HIGH

Permissive List of Allowed Inputs (CWE-183)

2026-04-16 security-advisories@github.com

Deserialization Dataease

8.3

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

7.7 HIGH

Network-reachable datasource API with low-privilege auth (PR:L) and no user interaction; arbitrary file read gives C:H with scope change (S:C) as leaked credentials affect other systems, and no integrity/availability impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:24 vuln.today

Analysis Generated

Jul 24, 2026 - 07:24 vuln.today

Patch released

Apr 20, 2026 - 16:42 nvd

Patch available

Apr 16, 2026 - 21:16 EUVD

EUVD ID Assigned

Apr 16, 2026 - 20:22 euvd

EUVD-2026-23293

CVE Published

Apr 16, 2026 - 20:16 nvd

HIGH 8.3

DescriptionGitHub Advisory

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a JDBC parameter blocklist bypass vulnerability in the MySQL datasource configuration. The Mysql class uses Lombok's @Data annotation, which auto-generates a public setter for the illegalParameters field that contains the JDBC security blocklist. When a datasource configuration is submitted as JSON, Jackson deserialization calls setIllegalParameters with an attacker-supplied empty list, replacing the blocklist before getJdbc() validation runs. This allows an authenticated attacker to include dangerous JDBC parameters such as allowLoadLocalInfile=true, and by pointing the datasource at a rogue MySQL server, exploit the LOAD DATA LOCAL INFILE protocol feature to read arbitrary files from the DataEase server filesystem, including sensitive environment variables and database credentials. This issue has been fixed in version 2.10.21.

AnalysisAI

Arbitrary file read in DataEase (open-source data visualization and analytics platform) versions 2.10.20 and below lets an authenticated attacker exfiltrate sensitive files from the server host by abusing the MySQL datasource configuration. Because the Mysql class exposes an auto-generated public setter for its JDBC security blocklist (via Lombok @Data), a crafted JSON datasource payload replaces the blocklist with an empty list before validation, enabling dangerous JDBC parameters like allowLoadLocalInfile=true. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but the technical chain is well-documented in the vendor GHSA advisory.

Technical ContextAI

The flaw lives in DataEase's datasource-configuration deserialization path. The Mysql configuration class holds an illegalParameters field enumerating a JDBC parameter blocklist meant to be enforced inside getJdbc(). Lombok's @Data annotation auto-generates a public setIllegalParameters setter, and when Jackson deserializes attacker-supplied JSON it invokes that setter, overwriting the blocklist with an empty collection before validation executes - a classic order-of-operations trust failure. This maps to CWE-183 (Permissive List of Allowed Inputs): the security control is a denylist that is itself mutable from untrusted input. The downstream primitive is MySQL's LOAD DATA LOCAL INFILE feature: a client configured with allowLoadLocalInfile=true will, when connecting to a malicious MySQL server, honor server-initiated requests to upload local files, turning a benign-looking datasource connection into an arbitrary file-read channel. Affected component per CPE is cpe:2.3:a:dataease:dataease across all versions up to the fix.

RemediationAI

Vendor-released patch: upgrade to DataEase 2.10.21, which fixes this arbitrary file read / credential exfiltration issue (see the release notes at https://github.com/dataease/dataease/releases/tag/v2.10.21 and advisory GHSA-944x-93jf-h3rx). Note that 2.10.21 introduces a breaking change - frontend user credential names gain a de_v2_ prefix (e.g., user.token becomes de_v2_user.token), which affects integrations such as SQLBot advanced apps, so test integrations before rolling out. Where immediate upgrade is not possible, restrict who can create or modify datasource configurations by tightening role/permission assignments so only trusted administrators hold datasource-edit rights (trade-off: reduces self-service analytics onboarding); apply egress network controls so the DataEase server cannot open outbound MySQL (TCP 3306 and any custom MySQL ports) connections to untrusted hosts, which blocks the rogue-server LOAD DATA LOCAL INFILE channel (trade-off: legitimate external MySQL datasources must be explicitly allowlisted); and monitor datasource JSON submissions for illegalParameters manipulation or JDBC parameters such as allowLoadLocalInfile. Since 2.10.21 also bundles fixes for several other CVEs, upgrading is strongly preferred over compensating controls alone.