CVE-2026-32140 Dataease: Redshift JDBC RCE Bypass
Attackers can force the Redshift JDBC driver to load arbitrary configuration files via the IniFile parameter, leading to remote code execution.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-32140?
CVE-2026-32140 is a critical path traversal vulnerability in Dataease Dataease, published on 12 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Dataease is an open source data visualization analysis tool. Prior to 2.10.20, By controlling the IniFile parameter, an attacker can force the JDBC driver to load an attacker-controlled configuration file. This configuration file can inject dangerous JDBC properties, leading to remote code execution. The Redshift JDBC driver execution flow reaches a method named getJdbcIniFile. The getJdbcIniFile method implements an aggressive automatic configuration file discovery mechanism. If not explicitly restricted, it searches for a file named rsjdbc.ini. In a JDBC URL context, users can explicitly specify the configuration file via URL parameters, which allows arbitrary files on the server to be loaded as JDBC configuration files. Within the Redshift JDBC driver properties, the parameter IniFile is explicitly supported and used to load an external configuration file. This vulnerability is fixed in 2.10.20.
Weakness: CWE-22
Which versions are affected by CVE-2026-32140?
It affects 1 product.
Products include Dataease Dataease.
How do I fix CVE-2026-32140?
No fix has been published for CVE-2026-32140 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-32140 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-32140 exists.
Other vulnerabilities in Dataease Dataease
- CVE-2024-57707 Code injection in n/a
- CVE-2024-46997 DataEase's H2 datasource has a remote command execution risk
- CVE-2023-33963 DataEase data source has deserialization vulnerability
- CVE-2023-28437 SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypassed
- CVE-2022-39312 Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability
Sources
Also known as GHSA-jc9q-3jfw-mch4.