PT-2026-33360 · Dataease · Dataease

Published 2026-04-16 · Updated 2026-05-25 · CVE-2026-40899

Positive Technologies (AI Summary)

CVSS v4.0

8.3

High

Base vector

AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.21

Description A JDBC parameter blocklist bypass exists in the MySQL datasource configuration. The Mysql class utilizes the Lombok @Data annotation, which automatically generates a public setter for the illegalParameters field containing the JDBC security blocklist. During JSON submission of a datasource configuration, Jackson deserialization invokes setIllegalParameters() with an attacker-supplied empty list, overriding the blocklist before the getJdbc() validation occurs. This enables an authenticated attacker to include dangerous JDBC parameters, such as allowLoadLocalInfile=true. By directing the datasource to a rogue MySQL server, the attacker can exploit the LOAD DATA LOCAL INFILE protocol feature to read arbitrary files from the server filesystem, including database credentials and sensitive environment variables.

Recommendations Update to version 2.10.21.

Exploit

Fix

Weakness Enumeration

CWE-183

Related Identifiers

CVE-2026-40899

Affected Products

Dataease

References · 5

• 🔥 https://github.com/dataease/dataease/security/advisories/GHSA-944x-93jf-h3rx · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2026-40899 · Security Note
• https://github.com/dataease/dataease/releases/tag/v2.10.21 · Note
• https://twitter.com/CVEnew/status/2045102652388696224 · Twitter Post
• https://reddit.com/r/SecOpsDaily/comments/1tn75zg/from_auth_bypass_to_rce_a_4vulnerability_exploit · Reddit Post