Which versions of DataEase are affected by CVE-2026-57172?

DataEase versions before 2.10.24 contain an authentication bypass vulnerability that allows attackers to forge valid share-link authorization tokens using a hardcoded key, enabling unauthorized…. A patch is available.

How to fix or mitigate CVE-2026-57172?

24 hours: Identify all DataEase instances and current versions; audit share-link access logs for suspicious activity; immediately revoke all passwordless shares until patching is complete. 7 days: Implement network segmentation restricting DataEase access; deploy enhanced logging and alerting on share-link token generation; block creation of new passwordless shares. 30 days: Upgrade all instances to DataEase 2.10.24 or later; reconfigure and re-test all share permissions; conduct full audit of data accessed via shared links.

DataEase CVE-2026-57172

Q: What is the CVSS score of CVE-2026-57172?

CVE-2026-57172 has a CVSS 4.0 base score of 8.3 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-42093 HIGH

Use of Hard-coded Cryptographic Key (CWE-321)

2026-07-07 GitHub_M

Authentication Bypass Dataease

8.3

CVSS 4.0 · Vendor: GitHub_M

Severity by source

Vendor (GitHub_M) PRIMARY

8.3 HIGH

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable and unauthenticated (AV:N/PR:N) but AC:H because the attacker must first obtain a passwordless share; primarily unauthorized read access (C:H) with limited integrity and no availability impact.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

4.0 AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 07, 2026 - 22:01 EUVD

Analysis Generated

Jul 07, 2026 - 21:24 vuln.today

DescriptionCVE.org

DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, ShareSecretManage uses a hardcoded default share link signature key, allowing an attacker who can obtain a passwordless share for a resource and user to use the known key link-pwd-fit2cloud to forge linkToken JWTs, bypass TokenFilter verification, and access backend resources as the share creator even if the original share has been revoked. This issue is fixed in version 2.10.24.

AnalysisAI

Authentication bypass in DataEase before 2.10.24 lets remote attackers forge valid share-link JWTs because ShareSecretManage ships with a hardcoded signature key (link-pwd-fit2cloud). An attacker who has obtained any passwordless share can mint linkToken JWTs that pass TokenFilter verification and access backend resources as the original share creator, even after that share has been revoked. There is no public exploit identified at time of analysis, but the hardcoded key is disclosed in the advisory, making forgery trivial once the signing algorithm is known.

Technical ContextAI

DataEase is an open source business-intelligence and data-visualization platform that exposes shareable links to dashboards and datasets. Access to shared resources is gated by JWTs (linkToken) validated in a TokenFilter using a signing key managed by ShareSecretManage. The root cause is CWE-321 (Use of a Hard-coded Cryptographic Key): the default share-link signature key is the static value 'link-pwd-fit2cloud' baked into the code rather than a per-instance secret. Because the key is identical across every default deployment, anyone who knows it can independently generate signatures that the server accepts as authentic, defeating the integrity and authenticity guarantees a JWT is supposed to provide. The affected component per CPE is cpe:2.3:a:dataease:dataease across all versions prior to the fix.

RemediationAI

Vendor-released patch: upgrade to DataEase 2.10.24 or later, which replaces the hardcoded share-link signature key; this is the definitive fix (advisory GHSA-7cpg-f4cj-7pgm, commit 356e83b518603f5612104760ced80aae8fc5d675). Because the key link-pwd-fit2cloud is now public, revoke and regenerate all existing share links after upgrading so any tokens forged before patching stop working. If immediate upgrade is not possible, restrict network exposure of the DataEase share endpoints to trusted networks or behind a VPN/reverse-proxy allowlist and disable passwordless sharing so attackers cannot obtain the initial share needed to trigger the flaw; the trade-off is that legitimate passwordless sharing workflows break and users must switch to password-protected shares. Monitor access logs for share tokens used after their share was revoked, which is a direct indicator of forgery.