Quick answers
- Is CVE-2026-42463 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-42463 being exploited in the wild.
- How severe is CVE-2026-42463?
- Informational severity, with a CVSS score of 8.6, published 13 May 2026.
- Which products and versions are affected?
- DataEase SQLBot < 1.8.0.
- Is there a fix for CVE-2026-42463?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-42463 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-42463?
- Check whether you run DataEase SQLBot at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
SQLBot prior to version 1.8.0 is vulnerable to an Insecure Direct Object Reference (IDOR) and authorization bypass in the /api/v1/datasource/exportDsSchema and /api/v1/datasource/uploadDsSchema endpoints. The vulnerability stems from two primary flaws: first, the lack of @require_permissions decorators on core API interfaces, which ensures authentication but fails to verify workspace ownership (oid) for a specific data source (ds_id). Second, a regression caused by upgrading to Pydantic > 2.0 resulted in the truncation of undeclared authorization fields during model instantiation, causing fine-grained permission checks to be bypassed. An authenticated attacker can exploit this to exfiltrate database schemas or modify metadata across different tenant workspaces. The issue is resolved in version 1.8.0.
Affected products
- DataEase SQLBot < 1.8.0
Timeline
- 2026-04-30: advisory: GitHub Security Advisory published
- 2026-05-13: disclosed: NVD publication date