Quick answers
- Is CVE-2026-46684 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-46684 being exploited in the wild.
- How severe is CVE-2026-46684?
- Informational severity, with a CVSS score of 9.5, published 15 July 2026.
- Which products and versions are affected?
- DataEase < 2.10.23.
- Is there a fix for CVE-2026-46684?
- A patch was published on 2026-05-28: Fixed in version 2.10.23 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-46684 attacked?
- It is attacked over the network, in a network appliance.
- Am I affected by CVE-2026-46684?
- Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
A vulnerability in DataEase Enterprise edition (prior to 2.10.23) exists because TokenFilter#doFilter() and TokenUtils.validate() only perform presence and length checks on the X-DE-TOKEN header. The system uses JWT.decode() to extract user identity (uid/oid) without verifying the cryptographic signature when LicenseUtil.licenseValid() is true. An attacker can forge a JWT to gain authenticated access. By combining this with a secondary vulnerability in the Redshift JDBC driver handling—specifically the lack of sanitization for 'loggerFile' and 'loggerLevel' parameters—an attacker can perform arbitrary file writes. In environments with default scheduled tasks (e.g., /etc/periodic/15min), this leads to unauthorized Remote Code Execution (RCE).
Affected products
- DataEase DataEase < 2.10.23
Timeline
- 2026-05-28: patched: Fixed in version 2.10.23
- 2026-05-28: advisory: GitHub Security Advisory published
- 2026-07-15: disclosed: NVD publication date