CVE-2026-104141
8.7HighPublished 14 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- Full C/I/A compromise
- Weakness
- CWE-89
Impact
Authenticated users with datasource access can execute arbitrary SQL queries against configured backend databases using the application's credentials. This allows them to read, modify, or delete database contents without victim interaction.
Root cause
CalciteProvider directly concatenates user-supplied database identifiers into metadata queries executed via a plain JDBC Statement without sanitization.
Affected systems
DataEase versions prior to 2.10.27.
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Fix & remediation
Upgrade DataEase to version 2.10.27 or later. As an interim workaround, restrict DataEase backend database user permissions to least privilege or revoke datasource configuration access from untrusted users.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate, save, and update flows. CalciteProvider inserts these identifiers into metadata queries that are executed through a plain JDBC Statement, allowing the generated SQL to be altered and run against the configured backend with application-held datasource credentials. The issue can compromise the confidentiality, integrity, and availability of the connected database without requiring a victim action.