# CVE-2026-45417: DataEase SQL injection in CalciteProvider datasource check

Source: https://junglewise.ai/threats/cve-2026-45417-dataease-sql-injection-in-calciteprovider-datasource-check  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-45417 · Severity: info · CVSS 8.7 · Published 2026-07-15

DataEase, an open-source data visualization and analysis tool, is vulnerable to a security flaw in how it handles database connections. An attacker with low-level user privileges can execute unauthorized database commands by providing a specially crafted schema name when configuring a data source. This could allow an attacker to view, modify, or delete sensitive information stored in connected databases such as DB2, SQL Server, and PostgreSQL.

Technologies: [DataEase](https://junglewise.ai/threats/technologies/dataease). Vendors: [DataEase](https://junglewise.ai/threats/vendors/dataease).

## Quick answers

**Is CVE-2026-45417 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45417 being exploited in the wild.

**How severe is CVE-2026-45417?** Informational severity, with a CVSS score of 8.7, published 15 July 2026.

**Which products and versions are affected?** DataEase < 2.10.23.

**Is there a fix for CVE-2026-45417?** A patch was published on 2026-05-13: Fix commit pushed to repository Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45417 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-45417?** Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in DataEase prior to version 2.10.23 within the `io.dataease.datasource.provider.CalciteProvider#checkStatus` method. The application fails to sanitize the `configuration.getSchema()` input before concatenating it into the `getTablesSql` query, which is subsequently executed via `executeQuery`. The vulnerability can be exploited via two paths: a blind injection during data source validation or a direct injection where results are echoed back to the frontend when retrieving table lists. The flaw affects multiple database providers including DB2, SQL Server, and PostgreSQL. The fix, introduced in version 2.10.23, replaces vulnerable string concatenation and `Statement` execution with `PreparedStatement` and parameterized queries.

## Affected products

- DataEase DataEase < 2.10.23

## Timeline

- 2026-05-13: patched: Fix commit pushed to repository
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: CVE published to NVD

## References

- [https://github.com/dataease/dataease/commit/f1c7204da1787ef812ee23cd3d51a1824126c1fb](https://github.com/dataease/dataease/commit/f1c7204da1787ef812ee23cd3d51a1824126c1fb)
- [https://github.com/dataease/dataease/releases/tag/v2.10.23](https://github.com/dataease/dataease/releases/tag/v2.10.23)
- [https://github.com/dataease/dataease/security/advisories/GHSA-rg6c-r9mv-39fr](https://github.com/dataease/dataease/security/advisories/GHSA-rg6c-r9mv-39fr)

## Related threats

- [DataEase cross-site scripting in SVG handler](https://junglewise.ai/threats/cve-2026-123992-a-flaw-has-been-found-in-dataease-up-to-2-10-27-affected-by-this)
- [DataEase authentication filter unrestricted file upload](https://junglewise.ai/threats/cve-2026-123991-a-vulnerability-was-detected-in-dataease-up-to-2-10-27-affected)
- [DataEase SQL injection in chart data handler](https://junglewise.ai/threats/cve-2026-123990-a-security-vulnerability-has-been-detected-in-dataease-up-to-2)
- [DataEase stored XSS in chart axis label tooltip](https://junglewise.ai/threats/cve-2026-102756-dataease-is-an-open-source-data-visualization-and-analysis-tool)
- [DataEase stored XSS in folder creation dialog](https://junglewise.ai/threats/cve-2026-102755-dataease-is-an-open-source-data-visualization-and-analysis-tool)