CVE-2026-32140

Dataease is an open source data visualization analysis tool. Prior to 2.10.20, By controlling the IniFile parameter, an attacker can force the JDBC driver to load an attacker-controlled configuration file. This configuration file can inject dangerous JDBC properties, leading to remote code execution. The Redshift JDBC driver execution flow reaches a method named getJdbcIniFile. The getJdbcIniFile method implements an aggressive automatic configuration file discovery mechanism. If not explicitly restricted, it searches for a file named rsjdbc.ini. In a JDBC URL context, users can explicitly specify the configuration file via URL parameters, which allows arbitrary files on the server to be loaded as JDBC configuration files. Within the Redshift JDBC driver properties, the parameter IniFile is explicitly supported and used to load an external configuration file. This vulnerability is fixed in 2.10.20.

• CWE-22

• https://github.com/dataease/dataease/security/advisories/GHSA-jc9q-3jfw-mch4Exploit, Vendor Advisory
• https://github.com/dataease/dataease/security/advisories/GHSA-jc9q-3jfw-mch4Exploit, Vendor Advisory

Published

Mar 12, 2026

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32135NanoMQ MQTT Broker (NanoMQ) is an all-around Edge Messaging …7.5
• CVE-2026-32136AdGuard Home is a network-wide software for blocking ads and…9.8
• CVE-2026-32137Dataease is an open source data visualization analysis tool.…8.8
• CVE-2026-32138NEXULEAN is a cybersecurity portfolio & service platform for…8.2
• CVE-2026-32139Dataease is an open source data visualization analysis tool.…5.4
• CVE-2026-3214Authentication Bypass Using an Alternate Path or Channel vul…6.5
• CVE-2026-32141flatted is a circular JSON parser. Prior to 3.4.0, flatted's…7.5
• CVE-2026-32142Shopware is an open commerce platform. /api/_info/config rou…5.3
• CVE-2026-32143Discourse is an open-source discussion platform. From versio…6.5
• CVE-2026-32144Improper Certificate Validation vulnerability in Erlang OTP …7.4
• CVE-2026-32145Allocation of Resources Without Limits or Throttling vulnera…7.5
• CVE-2026-32146Improper path validation vulnerability in the Gleam compiler…7.8