# CVE-2026-57172: DataEase hardcoded JWT signature key in ShareSecretManage

Source: https://junglewise.ai/threats/cve-2026-57172-dataease-hardcoded-jwt-signature-key-in-sharesecretmanage  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07. Updated: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2026-57172 · Severity: info · CVSS 8.3 · Published 2026-07-07

DataEase is an open-source data visualization and analysis tool used to create dashboards and reports. A security flaw in the way the system handles shared links allows unauthorized individuals to bypass security checks and access private data. By exploiting a hardcoded security key, an attacker can impersonate the person who created a share link, gaining access to backend resources like datasets and charts even if the original link was revoked.

Technologies: [DataEase](https://junglewise.ai/threats/technologies/dataease). Vendors: [DataEase](https://junglewise.ai/threats/vendors/dataease).

## Quick answers

**Is CVE-2026-57172 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57172 being exploited in the wild.

**How severe is CVE-2026-57172?** Informational severity, with a CVSS score of 8.3, published 7 July 2026.

**Which products and versions are affected?** DataEase < 2.10.24.

**Is there a fix for CVE-2026-57172?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-57172 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-57172?** Check whether you run DataEase at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in the `ShareSecretManage` class within the `core-backend` module. When a user creates a share link without a custom password, the system defaults to using a hardcoded HMAC-SHA256 signature key (`link-pwd-fit2cloud`) defined via a Spring `@Value` annotation. An attacker who obtains a valid resource ID and user ID can forge a `linkToken` JWT using this known key. Because the `TokenFilter` verification logic falls back to this same hardcoded default when no password is set for a share, the forged token will pass signature verification. This allows the attacker to bypass `TokenFilter` and access backend resources (dashboards, datasets, etc.) with the identity of the share creator, even if the original share has been revoked. This issue is an incomplete fix for a similar previous vulnerability (CVE-2024-52295).

## Affected products

- DataEase DataEase < 2.10.24

## Timeline

- 2026-06-18: advisory: GitHub advisory published by vendor
- 2026-07-07: disclosed: CVE published to NVD

## References

- [https://github.com/dataease/dataease/commit/356e83b518603f5612104760ced80aae8fc5d675](https://github.com/dataease/dataease/commit/356e83b518603f5612104760ced80aae8fc5d675)
- [https://github.com/dataease/dataease/security/advisories/GHSA-7cpg-f4cj-7pgm](https://github.com/dataease/dataease/security/advisories/GHSA-7cpg-f4cj-7pgm)

## Related threats

- [DataEase cross-site scripting in SVG handler](https://junglewise.ai/threats/cve-2026-123992-a-flaw-has-been-found-in-dataease-up-to-2-10-27-affected-by-this)
- [DataEase authentication filter unrestricted file upload](https://junglewise.ai/threats/cve-2026-123991-a-vulnerability-was-detected-in-dataease-up-to-2-10-27-affected)
- [DataEase SQL injection in chart data handler](https://junglewise.ai/threats/cve-2026-123990-a-security-vulnerability-has-been-detected-in-dataease-up-to-2)
- [DataEase stored XSS in chart axis label tooltip](https://junglewise.ai/threats/cve-2026-102756-dataease-is-an-open-source-data-visualization-and-analysis-tool)
- [DataEase stored XSS in folder creation dialog](https://junglewise.ai/threats/cve-2026-102755-dataease-is-an-open-source-data-visualization-and-analysis-tool)