CVE-2026-104141
Deferred Deferred - Pending Action

Authenticated SQL Injection in DataEase via Metadata Operations

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description
DataEase is an open source data visualization and analysis tool. Authenticated users with datasource access can supply crafted schema names, connection usernames, table names, or database names to datasource metadata operations, including getSchema, validate, save, and update flows. CalciteProvider inserts these identifiers into metadata queries that are executed through a plain JDBC Statement, allowing the generated SQL to be altered and run against the configured backend with application-held datasource credentials. The issue can compromise the confidentiality, integrity, and availability of the connected database without requiring a victim action.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-14
Last Modified
2026-10-15
Generated
2026-10-19
AI Q&A
2026-10-15
EPSS Evaluated
2026-10-18
NVD
CVE-2026-104141
EUVD
EUVD-2026-101608

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
dataease dataease < 2.10.26

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-89 The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a SQL injection vulnerability in DataEase, a data visualization tool. Authenticated users with datasource access can inject malicious SQL commands through schema names, table names, or database names. The application uses these inputs in SQL queries without proper sanitization, allowing attackers to alter queries and execute arbitrary commands on the backend database using the application's credentials.

Detection Guidance

To detect this vulnerability, inspect DataEase logs for suspicious SQL queries or errors related to metadata operations. Check for unauthorized access attempts to datasource endpoints like /getSchema, /validate, /save, or /update. Monitor for unusual database activity or queries containing crafted identifiers.

Impact Analysis

An attacker could exploit this to read, modify, or delete sensitive data in the connected database, escalate privileges, or execute system commands. Since the attack uses the application's credentials, it bypasses user-level restrictions and can compromise the entire database.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. Non-compliance risks include legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade DataEase to version 2.10.27 or later. Ensure input validation and sanitization for schema names, table names, and other metadata identifiers. Replace plain JDBC statements with parameterized queries. Review and restrict access to datasource configuration endpoints.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104141. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart