DataEase: SQL injection in datasource metadata identifiers

Summary

DataEase, an open-source data visualization and analysis tool, does not properly neutralize schema names, connection usernames, table names and database names in datasource metadata operations such as getSchema, validate, save and update. These values are inserted into SQL statements that run through a plain JDBC Statement. An authenticated user with datasource access can craft these identifiers to alter the queries and run arbitrary SQL against the connected database with the application's stored datasource credentials. This can affect confidentiality, integrity and availability, and no victim interaction is required.

Affected

• DataEase versions before 2.10.26 (according to the CNA record)
• Other sources list up to 2.10.25 or a range up to 2.10.27; the exact range is unconfirmed.

Fixed in

• Fix commit 181bb5cb95a1174f04689b3b6042d5e0c71b782d
• Release v2.10.27 is the release linked by the advisory. Unknown whether the fix is already included in 2.10.26.

Workaround

Unknown. No vendor workaround has been published. Until patched:

• Restrict datasource create and edit rights in DataEase to trusted users.
• Keep DataEase off the public internet or only reachable via VPN or SSO.
• Use least-privilege database accounts for all configured datasources.

Exploitation

• No confirmed exploitation in the wild is known.
• The CISA SSVC assessment lists exploitation as "poc" and automatable as "no".
• Public proof-of-concept status is inconsistent between sources; treat a PoC as possible.
• Not listed in CISA KEV. EPSS is low (about 0.003).

Our recommendation

• Upgrade to DataEase 2.10.27 or later and verify the fixed version in the GitHub advisory.
• Until patched, limit datasource rights to trusted users and restrict network access to DataEase.
• Review datasource database accounts for least privilege and monitor DataEase logs for unusual SQL errors or metadata requests.
• Check whether your DataEase instance is internet-facing and prioritise it if it is.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Fix commit 181bb5cb95a1174f04689b3b6042d5e0c71b782d github.com
• DataEase release v2.10.27 github.com
• GitHub Security Advisory GHSA-8hgp-vw27-hxph github.com
• VulDB entry for CVE-2026-104141 vuldb.com
• OpenCVE record for CVE-2026-104141 app.opencve.io
• Mend record via Vulners vulners.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 02:45.