CVE-2026-40899 Details
Description
DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a JDBC parameter blocklist bypass vulnerability in the MySQL datasource configuration. The Mysql class uses Lombok's @Data annotation, which auto-generates a public setter for the illegalParameters field that contains the JDBC security blocklist. When a datasource configuration is submitted as JSON, Jackson deserialization calls setIllegalParameters with an attacker-supplied empty list, replacing the blocklist before getJdbc() validation runs. This allows an authenticated attacker to include dangerous JDBC parameters such as allowLoadLocalInfile=true, and by pointing the datasource at a rogue MySQL server, exploit the LOAD DATA LOCAL INFILE protocol feature to read arbitrary files from the DataEase server filesystem, including sensitive environment variables and database credentials. This issue has been fixed in version 2.10.21.
A JDBC parameter blocklist bypass vulnerability has been identified in DataEase versions 2.10.20 and prior. This vulnerability allows authenticated attackers to manipulate JDBC parameters in a way that could lead to arbitrary file read operations. The issue arises because the MySQL datasource configuration improperly handles the blocklist of illegal parameters. Exploitation involves sending a crafted datasource configuration that bypasses the blocklist, enabling the inclusion of dangerous JDBC parameters. When the datasource is validated, the MySQL driver can be tricked into reading sensitive files from the server's filesystem, such as environment variables and database credentials.
Users are advised to upgrade to DataEase version 2.10.21, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/dataease/dataease/releases/tag/v2.10.21 | [email protected] | Release Notes |
| https://github.com/dataease/dataease/security/advisories/GHSA-944x-93jf-h3rx | [email protected] | ExploitThird Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-183 | Permissive List of Allowed Inputs | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dataease dataease | < 2.10.21 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 20, 2026 | Initial Analysis | [email protected] |
| Apr 16, 2026 | New CVE Received | [email protected] |