DataEase Open Source Tool Exposes Vulnerabilities Through Schema Manipulation

CVE-2026-104141

What is CVE-2026-104141?

DataEase is an open-source data visualization and analysis tool that allows authenticated users with access to data sources to manipulate schema names, connection usernames, and database identifiers. This manipulation can affect several metadata operations, including schema retrieval and updates, by injecting crafted identifiers into the SQL queries executed through a plain JDBC Statement. Consequently, this vulnerability risks the confidentiality, integrity, and availability of the connected database without requiring any action from the victim, thereby exposing organizations to significant security threats.

References