DataEase SQL Injection CVE-2026-104141 Patched in Version 2.10.26

DataEase version 2.10.26 addresses a high-severity SQL injection vulnerability identified as CVE-2026-104141. The flaw allows authenticated users to alter generated SQL commands against connected backend databases.

What happened

The National Vulnerability Database records CVE-2026-104141 as a high-severity issue affecting DataEase versions earlier than 2.10.26. DataEase is an open-source tool designed for data visualization and analysis tasks. The vulnerability stems from how the application handles metadata operations within its datasource management features.

Authenticated users who possess datasource access can trigger the exploit by supplying crafted inputs. These inputs include schema names, connection usernames, table names, or database names. The flaw occurs during specific metadata operations such as getSchema, validate, save, and update flows.

The underlying cause involves the CalciteProvider component within the application. This component inserts user-supplied identifiers directly into metadata queries. These queries are executed through a plain JDBC Statement without proper sanitization or parameterization.

This execution method allows the generated SQL to be altered. The modified queries run against the configured backend database using application-held datasource credentials. Consequently, the issue can compromise the confidentiality, integrity, and availability of the connected database.

Why it matters

Exploitation of this flaw can compromise the confidentiality, integrity, and availability of the connected database. The National Vulnerability Database assigns a CVSS score of 8.7, classifying the severity as high. This rating reflects the potential impact on the connected database systems.

The attack does not require any additional action from a victim user. An authenticated attacker with datasource permissions can execute the exploit independently. This lowers the barrier for malicious actors to gain unauthorized access to sensitive data stores.

As Patch Gazette reported on 2026-10-16, DataEase has addressed related SQL injection risks in version 2.10.26. That previous report covered CVE-2026-104143, which involved custom date formats. The current finding highlights ongoing risks in metadata handling within the same version update cycle.

What to watch

• Verify that all DataEase instances are running version 2.10.26 or later
• Monitor database logs for unexpected query patterns from authenticated users
• Review datasource permissions to ensure least-privilege access is enforced
• Audit recent changes to schema names or connection credentials for anomalies

Who needs to act first

Teams usually prioritize systems exposed to internal users with datasource access. Check whether any instances run versions prior to 2.10.26 in production environments. Roll out the update to systems handling sensitive data first. Test the patch in a staging environment to ensure compatibility with existing workflows. Back up configuration files before applying the update. Reduce exposure by restricting datasource access to trusted administrators while the patch is deployed.

Background: CVSS score

The CVSS score explains vulnerability severity using a 0.0 to 10.0 scale. It measures attack vector, complexity, privileges required, and impact on confidentiality, integrity, and availability. You use this metric to prioritize patches, though you must adjust it for your specific environment to avoid wasting time on irrelevant threats.

Read the full guide: CVSS Score Explained: How to Read Risk Metrics and Prioritize Fixes

What to do and how to stay safe: DataEase

• Inventory all DataEase installations and check their current version numbers
• Apply the update to version 2.10.26 on all affected systems immediately
• Review access logs for signs of unauthorized metadata queries or schema changes
• Monitor database performance for anomalies that might indicate ongoing exploitation

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which versions of DataEase are affected by CVE-2026-104141?

All DataEase versions prior to 2.10.26 are affected by this SQL injection vulnerability.

Does the attacker need to be an administrator to exploit this flaw?

No, an authenticated user with datasource access can exploit the vulnerability.

Is there a confirmed fix for CVE-2026-104141?

Yes, the issue is patched in DataEase version 2.10.26.