CVE-2026-32939

DataEase is an open source data visualization analysis tool. Versions 2.10.19 and below have inconsistent Locale handling between the JDBC URL validation logic and the H2 JDBC engine's internal parsing. DataEase uses String.toUpperCase() without specifying an explicit Locale, causing its security checks to rely on the JVM's default runtime locale, while H2 JDBC always normalizes URLs using Locale.ENGLISH. In Turkish locale environments (tr_TR), Java converts the lowercase letter i to İ (dotted capital I) instead of the standard I, so a malicious parameter like iNIT becomes İNIT in DataEase's filter (bypassing its blacklist) while H2 still correctly interprets it as INIT. This discrepancy allows attackers to smuggle dangerous JDBC parameters past DataEase's security validation, and the issue has been confirmed as exploitable in real DataEase deployment scenarios running under affected regional settings. The issue has been fixed in version 2.10.20.

• CWE-178

• https://github.com/dataease/dataease/commit/8f1c21834a620d37dafb3fa24605c059d0a5b80dPatch
• https://github.com/dataease/dataease/releases/tag/v2.10.20Product, Release Notes
• https://github.com/dataease/dataease/security/advisories/GHSA-pj7p-3m49-52qqExploit, Vendor Advisory

Published

Mar 20, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-32933AutoMapper is a convention-based object-object mapper in .NE…7.5
• CVE-2026-32934CoreDNS is a DNS server that chains plugins. In versions pri…7.5
• CVE-2026-32935phpseclib is a PHP secure communications library. Projects u…5.9
• CVE-2026-32936CoreDNS is a DNS server that chains plugins. In versions pri…7.5
• CVE-2026-32937free5GC is an open source 5G core network. free5GC CHF prior…6.5
• CVE-2026-32938SiYuan is a personal knowledge management system. In version…6.5
• CVE-2026-3294An authentication logic vulnerability in multiple TP-Link ra…8.8
• CVE-2026-32940SiYuan is a personal knowledge management system. In version…6.1
• CVE-2026-32941Sliver is a command and control framework that uses a custom…6.5
• CVE-2026-32942PJSIP is a free and open source multimedia communication lib…8.1
• CVE-2026-32943Parse Server is an open source backend that can be deployed …3.1
• CVE-2026-32944Parse Server is an open source backend that can be deployed …7.5