CVE-2026-40901 DataEase: Quartz Deserialization → Remote Code Execution
An authenticated attacker can achieve remote code execution by injecting malicious payloads into Quartz job data, which are deserialized without filters.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-40901?
CVE-2026-40901 is a high-severity unsafe deserialization vulnerability in Dataease Dataease, published on 16 Apr 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing the InvokerTransformer deserialization gadget chain. Quartz 2.3.2, also bundled in the application, deserializes job data BLOBs from the qrtz_job_details table using ObjectInputStream with no deserialization filter or class allowlist. An authenticated attacker who can write to the Quartz job table, such as through the previously described SQL injection in previewSql, can replace a scheduled job's JOB_DATA with a malicious CommonsCollections6 gadget chain payload. When the Quartz cron trigger fires, the payload is deserialized and executes arbitrary commands as root inside the container, achieving full remote code execution. This issue has been fixed in version 2.10.21.
Weakness: CWE-502
Which versions are affected by CVE-2026-40901?
It affects 1 product.
Products include Dataease Dataease.
How do I fix CVE-2026-40901?
No fix has been published for CVE-2026-40901 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2026-40901 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-40901 exists.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Dataease Dataease
- CVE-2024-57707 Code injection in n/a
- CVE-2024-46997 DataEase's H2 datasource has a remote command execution risk
- CVE-2023-33963 DataEase data source has deserialization vulnerability
- CVE-2023-28437 SQL injection vulnerability due to the keyword blacklist for defending against SQL injection will be bypassed
- CVE-2022-39312 Dataease Mysql Data Source JDBC Connection Parameters Not Verified Leads to Deserialization Vulnerability
Sources
Also known as GHSA-gm5q-g72w-c466.