PT-2026-33363 · Dataease · Dataease

CVE-2026-40900 · Published 2026-04-16 · Updated 2026-05-25

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DataEase versions prior to 2.10.21

Description An issue exists in the '/de2api/datasetData/previewSql' endpoint where user-supplied SQL is wrapped in a subquery without validation to ensure the input is a single SELECT statement. By utilizing a JDBC blocklist bypass to enable allowMultiQueries=true, an authenticated attacker with valid datasource credentials can execute arbitrary stacked SQL statements, including UPDATE and other write operations, resulting in full read and write access to the connected database.

Recommendations Update to version 2.10.21.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-40900

GHSA-VQXF-84PH-J3VX

Affected Products

Dataease

References · 7

• 🔥 https://github.com/dataease/dataease/security/advisories/GHSA-vqxf-84ph-j3vx · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/40xxx/CVE-2026-40900.json · Exploit
• https://osv.dev/vulnerability/CVE-2026-40900 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-40900 · Security Note
• https://github.com/dataease/dataease/releases/tag/v2.10.21 · Note
• https://reddit.com/r/SecOpsDaily/comments/1tn75zg/from_auth_bypass_to_rce_a_4vulnerability_exploit · Reddit Post
• https://twitter.com/CVEnew/status/2045102651331731713 · Twitter Post