# CVE-2026-45534: DataEase Remote Code Execution in Redshift datasource connection

Source: https://junglewise.ai/threats/cve-2026-45534-dataease-remote-code-execution-in-redshift-datasource-connection  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-15. Updated: 2026-07-15  
License: CC BY 4.0 with a link back

CVE-2026-45534 · Severity: info · CVSS 9 · Published 2026-07-15

DataEase is an open-source data visualization and analysis platform. A security vulnerability in how it handles Amazon Redshift data source connections allows an attacker to execute arbitrary commands on the server. This could lead to a complete system takeover, unauthorized access to sensitive business data, and disruption of operations. Organizations using DataEase should upgrade to version 2.10.23 or later to mitigate this risk.

Technologies: [DataEase](https://junglewise.ai/threats/technologies/dataease). Vendors: [DataEase](https://junglewise.ai/threats/vendors/dataease).

## Quick answers

**Is CVE-2026-45534 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45534 being exploited in the wild.

**How severe is CVE-2026-45534?** Informational severity, with a CVSS score of 9, published 15 July 2026.

**Which products and versions are affected?** DataEase < 2.10.23.

**Is there a fix for CVE-2026-45534?** A patch was published on 2026-05-28: Version 2.10.23 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45534 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-45534?** Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

DataEase is vulnerable to a reflection-based Remote Code Execution (RCE) chain within its Redshift data source connector. The vulnerability stems from the Amazon Redshift JDBC driver's behavior of automatically searching for and loading a configuration file named 'rsjdbc.ini' from several locations, including the system's temporary directory. An attacker who can place a malicious configuration file in this directory can specify a 'socketFactory' (such as Spring's FileSystemXmlApplicationContext) and a 'socketFactoryArg' pointing to a malicious XML payload. When a JDBC connection is subsequently initiated through 'io.dataease.datasource.type.Redshift', the driver instantiates the attacker-controlled class, leading to code execution. This effectively bypasses existing Redshift driver security mechanisms. The issue is resolved in version 2.10.23 by explicitly nullifying the relevant system properties.

## Affected products

- DataEase DataEase < 2.10.23

## Timeline

- 2026-05-28: patched: Version 2.10.23 released
- 2026-07-15: disclosed: CVE-2026-45534 published

## References

- [https://github.com/dataease/dataease/commit/3e58149f1e014b1a7ae2c12134b37ae438f676ac](https://github.com/dataease/dataease/commit/3e58149f1e014b1a7ae2c12134b37ae438f676ac)
- [https://github.com/dataease/dataease/releases/tag/v2.10.23](https://github.com/dataease/dataease/releases/tag/v2.10.23)
- [https://github.com/dataease/dataease/security/advisories/GHSA-cv4c-8rpv-2x97](https://github.com/dataease/dataease/security/advisories/GHSA-cv4c-8rpv-2x97)

## Related threats

- [DataEase cross-site scripting in SVG handler](https://junglewise.ai/threats/cve-2026-123992-a-flaw-has-been-found-in-dataease-up-to-2-10-27-affected-by-this)
- [DataEase authentication filter unrestricted file upload](https://junglewise.ai/threats/cve-2026-123991-a-vulnerability-was-detected-in-dataease-up-to-2-10-27-affected)
- [DataEase SQL injection in chart data handler](https://junglewise.ai/threats/cve-2026-123990-a-security-vulnerability-has-been-detected-in-dataease-up-to-2)
- [DataEase stored XSS in chart axis label tooltip](https://junglewise.ai/threats/cve-2026-102756-dataease-is-an-open-source-data-visualization-and-analysis-tool)
- [DataEase stored XSS in folder creation dialog](https://junglewise.ai/threats/cve-2026-102755-dataease-is-an-open-source-data-visualization-and-analysis-tool)