Which versions of DataEase are affected by CVE-2026-40901?

DataEase (open-source BI platform, versions 2.10.20 and below) contains a remote code execution vulnerability allowing attackers to execute arbitrary commands with root privileges.. A patch is available.

How to fix or mitigate CVE-2026-40901?

Within 24 hours, inventory all DataEase deployments and document their current versions. Within 7 days, apply the available vendor patch to upgrade all instances to a version above 2.10.20. Within 30 days, implement role-based access controls limiting database access to the job scheduler tables and review audit logs for signs of exploitation attempts.

DataEase CVE-2026-40901

Q: What is the CVSS score of CVE-2026-40901?

CVE-2026-40901 has a CVSS 4.0 base score of 7.5 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.4%.

EUVD-2026-23310 HIGH

Deserialization of Untrusted Data (CWE-502)

2026-04-16 GitHub_M

Deserialization RCE SQLi Dataease

7.5

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

8.5 HIGH

Network-reachable but AC:H because it requires chaining a separate SQLi write plus a cron trigger firing; PR:L for authenticated access; S:C and C/I/A:H for root RCE breaking out of the app context.

3.1 AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Source Code Evidence Fetched

Jul 24, 2026 - 07:22 vuln.today

Analysis Generated

Jul 24, 2026 - 07:22 vuln.today

Patch released

Apr 20, 2026 - 16:46 nvd

Patch available

Apr 16, 2026 - 22:46 EUVD

CVSS changed

Apr 16, 2026 - 21:22 NVD

7.5 (HIGH)

EUVD ID Assigned

Apr 16, 2026 - 21:15 euvd

EUVD-2026-23310

CVE Published

Apr 16, 2026 - 20:57 nvd

HIGH 7.5

DescriptionGitHub Advisory

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing the InvokerTransformer deserialization gadget chain. Quartz 2.3.2, also bundled in the application, deserializes job data BLOBs from the qrtz_job_details table using ObjectInputStream with no deserialization filter or class allowlist. An authenticated attacker who can write to the Quartz job table, such as through the previously described SQL injection in previewSql, can replace a scheduled job's JOB_DATA with a malicious CommonsCollections6 gadget chain payload. When the Quartz cron trigger fires, the payload is deserialized and executes arbitrary commands as root inside the container, achieving full remote code execution. This issue has been fixed in version 2.10.21.

AnalysisAI

Remote code execution in DataEase (open-source BI/data-visualization platform) versions 2.10.20 and below allows an authenticated attacker to run arbitrary commands as root by abusing an unsafe Java deserialization path in the bundled Quartz 2.3.2 scheduler. Because Quartz reads job-data BLOBs from the qrtz_job_details table via ObjectInputStream with no class filter, and the shipped commons-collections-3.2.1 (pulled in by velocity-1.7.jar) exposes the InvokerTransformer gadget, an attacker who can write to the job table - e.g. by chaining the previously disclosed previewSql SQL injection - plants a CommonsCollections6 payload that fires when the cron trigger runs. SSVC rates technical impact as total with a proof-of-concept exploit; EPSS is low at 0.40% (61st percentile) and it is not in CISA KEV, so this is currently a PoC-stage rather than mass-exploited issue.

Technical ContextAI

The root cause is CWE-502 (Deserialization of Untrusted Data). DataEase bundles the Quartz job scheduler (2.3.2), which persists job state as serialized Java objects (JOB_DATA BLOBs) in the qrtz_job_details table and rehydrates them with a raw ObjectInputStream lacking any ObjectInputFilter or class allowlist. The exploitable gadget chain comes from Apache Commons Collections 3.2.1 (specifically the InvokerTransformer/CommonsCollections6 chain), which is transitively dragged in by the legacy velocity-1.7.jar. When these two conditions coexist - attacker-controllable serialized data and a vulnerable gadget on the classpath - deserialization becomes arbitrary method invocation and thus command execution. The affected package per CPE is cpe:2.3:a:dataease:dataease:*, and the process runs as root inside its container, so successful deserialization yields root-level RCE within that container context.

RemediationAI

Upgrade to DataEase 2.10.21, which is the vendor-released patch that removes/hardens the vulnerable Quartz deserialization path and was shipped alongside fixes for the related SQL injection chain (per release notes at https://github.com/dataease/dataease/releases/tag/v2.10.21 and advisory https://github.com/dataease/dataease/security/advisories/GHSA-gm5q-g72w-c466). If you cannot patch immediately, break the attack chain rather than the gadget: restrict and monitor write access to the backing database so the qrtz_job_details table cannot be tampered with by application-level SQL injection (least-privilege DB accounts, WAF/parameterization for the previewSql and related endpoints fixed in the same release), and place DataEase behind authenticated network controls so untrusted users cannot reach the admin/scheduling surfaces - note this reduces exposure but does not remove the vulnerable ObjectInputStream. Where feasible, run the container as an unprivileged (non-root) user to limit blast radius, accepting that this mitigates impact but not the RCE itself. Removing velocity-1.7.jar/commons-collections-3.2.1 from the classpath would eliminate the gadget but is likely to break functionality and is not a supported configuration, so upgrading remains the correct fix.