EUVD-2026-18515
GHSA-2v29-2pv7-f546
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V4 - API and Web Service URL allowlisting, SSRF prevention
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Credential Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | The CVSS v4.0 score of 5.1 with vector AV:N/AC:L/PR:H indicates a network-exploitable vulnerability requiring high-level privileges (PR:H), with low confidentiality, integrity, and availability impact. The CVSS metric E:P denotes publicly available exploit code, which is confirmed by the Notion document reference showing working SSRF proof-of-concept. While CVSS scoring shows low direct impact (VC:L/VI:L/VA:L), SSRF vulnerabilities are strategically significant because they enable reconnaissance and lateral movement within internal networks-potential impact extends beyond the direct CVSS assessment. The high-privilege requirement (PR:H) substantially reduces exploitation surface compared to unauthenticated SSRF variants. Real-world risk is moderate: the privilege barrier limits casual exploitation, but insiders or compromised high-privilege accounts pose realistic threats. The availability of public exploit code and patch (v1.7.0) indicates vendor response was timely. |
| Exploit ScenarioDerived | An administrator with high-level credentials (meeting the PR:H requirement) could supply a malicious 'address' parameter to the get_es_data_by_http function via the Elasticsearch Handler interface, causing the SQLBot server to initiate HTTP requests to internal systems (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata, or http://internal-database:5432 for internal service discovery). The public Notion-hosted proof-of-concept demonstrates this attack path, allowing reconnaissance of the internal network without direct access. An insider or attacker with compromised admin credentials poses the primary realistic threat under this privilege model. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 02, 2026
Server-side request forgery (SSRF) in Dataease SQLBot up to version 1.6.0 allows high-privileged remote attackers to manipulate the 'address' argument in the Elasticsearch Handler component (get_es_data_by_http function), enabling unauthorized HTTP requests to internal or external systems. The vulnerability has publicly available exploit code and vendor-released patch version 1.7.0 addresses the issue.
RemediationAI
Vendor-released patch: upgrade to Dataease SQLBot version 1.7.0 or later. Organizations running SQLBot 1.6.0 or earlier should prioritize this upgrade, particularly if the deployment has high-privilege user accounts or operates in network segments with sensitive internal systems. The patch is available at https://github.com/dataease/SQLBot/releases/tag/v1.7.0. Pending upgrade, restrict network access to the SQLBot instance using firewall rules to limit outbound HTTP/HTTPS requests to known and necessary Elasticsearch endpoints, and audit Elasticsearch Handler logs for suspicious address parameters. Apply principle of least privilege by restricting high-privilege account creation and access to the affected component.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the Elasticsearch Handler component of Dataease SQLBot, specifically in the get_es_data_by_http function located at backend/apps/db/es_engine.py. This function handles HTTP communication with Elasticsearch clusters but fails to properly validate the 'address' parameter before using it in server-side HTTP requests. CWE-918 (Server-Side Request Forgery) indicates the root cause is inadequate input validation on user-controlled URLs, allowing attackers to craft malicious address parameters that force the server to make unintended HTTP requests to arbitrary internal or external targets. The Elasticsearch integration component is designed to facilitate data queries but becomes a vector for SSRF when address validation is insufficient.
Know when Dataease gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Primary rating from Vendor (VulDB) · only source for this CVE.
CVSS VectorVendor: VulDB
Lifecycle Timeline
5DescriptionCVE.org
A vulnerability was determined in Dataease SQLbot up to 1.6.0. This issue affects the function get_es_data_by_http of the file backend/apps/db/es_engine.py of the component Elasticsearch Handler. This manipulation of the argument address causes server-side request forgery. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.7.0 is capable of addressing this issue. You should upgrade the affected component. The vendor was contacted early about this disclosure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Server-Side Request Forgery exploits applications that fetch remote resources based on user-supplied URLs.
DataEase is an open source business intelligence and data visualization tool. Prior to version 2.10.11, a threat actor m
Auth bypass in DataEase via CVE-2025-49001 patch evasion. PoC available.
Auth bypass in DataEase BI tool before 2.10.10.
A remote code execution vulnerability in DataEase (CVSS 9.8). Risk factors: public PoC available.
A remote code execution vulnerability in DataEase (CVSS 9.8). Risk factors: public PoC available.
A remote code execution vulnerability in DataEase (CVSS 9.8). Risk factors: public PoC available.
DataEase data visualization tool prior to 2.10.19 uses MD5-hashed passwords without salting, allowing attackers to crack
DataEase is an open source data visualization analysis tool. Rated critical severity (CVSS 9.8), this vulnerability is r
DataEase is an open source data visualization analysis tool. Rated critical severity (CVSS 9.8), this vulnerability is r
DataEase is an open source data visualization and analysis tool. Rated critical severity (CVSS 9.8), this vulnerability
Dataease is an open source data visualization and analysis tool. Rated critical severity (CVSS 9.8), this vulnerability
Dataease is an open source data visualization analysis tool. Rated critical severity (CVSS 9.8), this vulnerability is r
Exploit-DB