What is the CVSS score of CVE-2026-40900?

CVE-2026-40900 has a CVSS 4.0 base score of 8.7 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N. EPSS exploitation probability: 0.0%.

How to fix or mitigate CVE-2026-40900?

Within 24 hours, create an inventory of all DataEase deployments in your environment, document their versions, and map which production databases are connected to each instance. Within 7 days, upgrade all affected installations to DataEase version 2.10.21 or later and review who has access to datasource credentials, removing any unnecessary account sharing. Within 30 days, audit your connected database transaction logs for unusual SQL patterns (UPDATE/DELETE/INSERT statements, or multi-statement executions) that may indicate exploitation attempts, and rotate credentials for any datasource accounts that may have been compromised.

DataEase CVE-2026-40900

EUVD-2026-23308 HIGH

SQL Injection (CWE-89)

2026-04-16 GitHub_M

SQLi Dataease

8.7

CVSS 4.0 · GitHub Advisory

View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

Access

Authenticate to DataEase with datasource access
Delivery

Craft stacked SQL for previewSql endpoint
Exploit

Bypass JDBC blocklist to set allowMultiQueries=true
Execution

Break out of read-only subquery
Persist

Execute stacked UPDATE/write statements
Impact

Full read/write control of backend database

Vulnerability Assessment

Weakness	CWE CWE-89 OWASP Top 10:2025 A05:2025 - Injection ASVS 5.0 V1 - Encoding and Sanitization Parameterized queries, prepared statements MITRE ATT&CK 2 techniques across 2 tactics: Initial Access, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. Sign in to read
Exploitation Conditions	Exploitation requires an authenticated DataEase account (CVSS PR:L) that has access to valid datasource credentials / a configured database connection, and the ability to reach the /de2api/datasetData/previewSql SQL-preview endpoint. The specific technical prerequisite is the JDBC blocklist bypass that lets the attacker force allowMultiQueries=true on the underlying JDBC driver (practically a MySQL/MariaDB-style driver that supports multi-statement queries), enabling stacked statements; without a datasource driver that honors multi-queries, write-operation stacking is limited. Limiting factors: it is NOT unauthenticated (an attacker with no DataEase login and no datasource access cannot exploit it), no user interaction is needed (UI:N), and only versions ≤ 2.10.20 are affected - 2.10.21 and later are fixed.
Impact	Signals are mixed. The CVSS 4.0 base score of 8.7 (High) with vector AV:N/AC:L/AT:N/PR:L/UI:N and total technical impact (VC:H/VI:H) reflects easy network exploitation and high database read/write impact, and SSVC rates it Automatable=yes with Technical Impact=total - meaning reliable, scriptable, high-consequence exploitation. However, PR:L means it is NOT unauthenticated: the attacker must already hold valid DataEase credentials with access to a configured datasource, which is a meaningful gate. Counterbalancing the high CVSS, the EPSS score is very low (0.03%, 8th percentile) and the CVE is not listed in CISA KEV, indicating no observed widespread exploitation despite public PoC availability. Net: a genuine priority for any internet-exposed or multi-tenant DataEase instance where low-privilege users should not have DBA-level write access, but the authentication requirement and low EPSS argue against treating it as an emergency drop-everything issue for well-segmented, credential-restricted deployments.
Exploit ScenarioDerived	A low-privilege but authenticated DataEase user who can reach a configured database datasource opens the SQL-dataset preview and submits crafted SQL to the /de2api/datasetData/previewSql endpoint. By abusing the JDBC blocklist bypass to enable allowMultiQueries=true, they append a second stacked statement (e.g. an UPDATE or INSERT) that breaks out of the read-only subquery and executes against the backend database. Public PoC/exploit code exists (SSVC: poc) and the attack is automatable, so weaponizing it into a repeatable script is straightforward given valid credentials.

This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).

Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Jul 24, 2026

Authenticated SQL injection in DataEase (open-source BI/data-visualization platform) versions 2.10.20 and below lets an attacker with valid datasource credentials achieve full read and write access to a connected database via the /de2api/datasetData/previewSql endpoint. User-supplied SQL is wrapped in a subquery without enforcing a single SELECT, and a JDBC blocklist bypass re-enables allowMultiQueries=true, allowing stacked statements such as UPDATE. Publicly available exploit code exists (SSVC: PoC), but EPSS is only 0.03% and it is not in CISA KEV, so no active exploitation is confirmed. Fixed in 2.10.21.

RemediationAI

Vendor-released patch: upgrade to DataEase 2.10.21 or later, which fixes the stacked-query SQL injection (release notes: https://github.com/dataease/dataease/releases/tag/v2.10.21; advisory: https://github.com/dataease/dataease/security/advisories/GHSA-vqxf-84ph-j3vx). Note that 2.10.21 introduces a breaking change - frontend user-info credentials gain a 'de_v2_' prefix (e.g. user.token becomes de_v2_user.token), which affects integrations such as SQLBot, so plan integration updates before upgrading. If immediate patching is impossible, compensating controls include restricting who holds valid datasource credentials and access to the SQL-dataset/previewSql feature (limit to trusted admins, since exploitation requires authenticated access), placing the DataEase management interface behind a VPN or IP allowlist to remove network reachability for untrusted users, and configuring the backend database accounts used by DataEase datasources with least-privilege, read-only grants so a successful injection cannot perform UPDATE/write operations - the trade-off being that read-only accounts may break legitimate write-back or ETL features that rely on those datasources. This release also bundles fixes for several other SQL-injection CVEs (CVE-2026-33082/33083/33084/33121/33122/33207), an XXE and arbitrary file read, so upgrading is strongly recommended over piecemeal mitigation.

Affected VersionsENISA

dataease < 2.10.21

Affected Packages

euvd dataease fix: 2.10.21

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Technical ContextAI · show details

DataEase is a Java/Spring-based open-source business-intelligence and data-visualization platform (CPE cpe:2.3:a:dataease:dataease) that connects to user-configured backend databases over JDBC and offers an SQL-dataset preview feature. The root cause is CWE-89 (Improper Neutralization of Special Elements used in an SQL Command): the previewSql endpoint embeds raw user SQL inside a wrapping subquery ('SELECT ... FROM (<user sql>)') without verifying the input is a single SELECT. The severity is amplified by a JDBC connection-string blocklist bypass that lets the attacker set allowMultiQueries=true on the underlying MySQL/MariaDB JDBC driver, which enables multiple semicolon-separated statements per query - turning a read-only preview into an arbitrary stacked-query execution primitive that can break out of the subquery and run write operations.

Know when Dataease gets its next vulnerability

Watch products and get an email when something new is published
Check this CVE against your own stack and servers
Exploit and PoC references, threat intelligence from 22 sources

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

GitHub Advisory PRIMARY 8.7 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

vuln.today AI 8.3 HIGH

Network endpoint, low complexity, but requires an authenticated user with datasource access (PR:L); stacked queries give high database confidentiality and integrity impact with limited availability effect.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

Attack Vector

Network

Attack Complexity

Low

Attack Requirements

None

Privileges Required

Low

User Interaction

None

Vulnerable system: Confidentiality

High

Vulnerable system: Integrity

High

Vulnerable system: Availability

Low

Subsequent system: Confidentiality

None

Subsequent system: Integrity

None

Subsequent system: Availability

None

Lifecycle Timeline

Patch released

Apr 20, 2026 - 16:46 nvd

Patch available

Apr 16, 2026 - 22:46 EUVD

CVSS changed

Apr 16, 2026 - 21:22 NVD

8.7 (HIGH)

CVE Published

Apr 16, 2026 - 20:53 nvd

HIGH 8.7

DescriptionGitHub Advisory

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /de2api/datasetData/previewSql endpoint. The user-supplied SQL is wrapped in a subquery without validation that the input is a single SELECT statement. Combined with the JDBC blocklist bypass that allows enabling allowMultiQueries=true, an attacker can break out of the subquery and execute arbitrary stacked SQL statements, including UPDATE and other write operations, against the connected database. An authenticated attacker with access to valid datasource credentials can achieve full read and write access to the underlying database. This issue has been fixed in version 2.10.21.

Executive ViewAI

Why It Matters

DataEase versions 2.10.20 and earlier contain an authenticated SQL injection vulnerability enabling attackers with datasource credentials to read and modify any connected database, affecting organizations relying on this open-source BI platform for data visualization and analytics. No active exploitation has been confirmed, but publicly available exploit code exists. Patching to version 2.10.21 eliminates the vulnerability.

Business Impact: High

Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score

0.0%

Top 92% exploitable

Prevalence

Medium

popular open-source BI/visualization platform, moderate enterprise footprint

Social Media

Sightings

Data Quality

6 sources

Confidence: High

EUVD

NVD

CVE.org

EPSS

Vulnrichment CIRCL

GitHub

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue

Severity HIGH

CISA KEV No

Public POC No

EPSS 0.0%

Patch available Yes

Active threat No

Deciding rule

HIGH severity (CVSS 7.0-8.9)

What every action level means

Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.

Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.

This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.

This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.

Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.