Remote Code Execution Vulnerability in DataEase by DataEase Technologies
CVE-2026-45534

9CRITICAL

Key Information:

Vendor

Dataease

Status
Dataease
Vendor
CVE Published:
15 July 2026

What is CVE-2026-45534?

DataEase, an open-source data visualization and analysis tool, has a vulnerability that allows attacker-controlled configuration files to be loaded during JDBC connections. This results in a potential remote code execution path through specific methods in the Amazon Redshift driver, leading to serious security risks if not addressed. The issue has been mitigated in version 2.10.23.

Affected Version(s)

dataease < 2.10.23

References

https://github.com/dataease/dataease/security/advisories/...
x_refsource_CONFIRM
https://github.com/dataease/dataease/commit/3e58149f1e014...
x_refsource_MISC
https://github.com/dataease/dataease/releases/tag/v2.10.23
x_refsource_MISC

CVSS V4

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.