CVE-2025-46566 is a critical flaw (CVSS 9.8 in the record) in DataEase, an open source BI tool, before version 2.10.9. The advisory says authenticated users can reach remote code execution through a backend JDBC connection. Upgrade to 2.10.9 and limit who can create data sources.
What's affected
The NVD record says DataEase versions before 2.10.9 are affected, and the GitHub advisory lists 2.10.8 and below with 2.10.9 as the patched release.
The advisory describes a data source type for which connection parameters were not filtered. A user who can configure that data source could make the server load and run content from a location the user controls. The advisory says the user must be authenticated, while the CVSS vector in the record shows no privileges required. Plan as if the flaw is reachable from any account that can create data sources, and check whether registration is open.
How to check if you're exposed
Check the version and who can add data sources.
- In the DataEase web console, open the about or system information page and read the version.
- Docker users: run the command shown below and look for the dataease image tag.
- Compare it with 2.10.9. Anything at or below 2.10.8 is affected.
- List the users and roles that can create or edit data sources.
- Check the server's outbound network access, since the flaw involves loading content from elsewhere.
Commands referred to above, in order:
docker ps --format '{{.Image}}'
What to do now
- Upgrade DataEase to 2.10.9 or later.
- Review user accounts and remove any that are not needed, especially those with data source permissions.
- Limit outbound connections from the DataEase server to the databases it needs, using firewall or network policy.
- Run the service as a non-privileged user in a container with a read only file system where possible.
- Check the data source list for entries you do not recognise and look at the server for unexpected files or processes.
- Rotate credentials stored in DataEase data sources if you find signs of misuse.
Why it matters
The record lists CWE-284 (Improper Access Control), CWE-923 (Improper Restriction of Communication Channel to Intended Endpoints). The advisory ties the flaw to the way a database driver handles connection settings. Drivers can be told to load extra configuration, and if the application passes user input into that setting without filtering, a connection test becomes a way to run code.
Business intelligence servers hold credentials for many databases, so code execution there is a path to the data behind them. The record does not mark this CVE as exploited in the wild, and it is not on the CISA Known Exploited Vulnerabilities list.
Whether the flaw is exploitable in your deployment depends on who can create data sources and what the server can reach, which is a question about exploitability, not only about version numbers.
Try it yourself
The demo walks through checking whether a flagged flaw can actually be used in your environment.
Click through it at your own pace, or open it full screen.
Quick check
Does an attacker need an account?
The advisory says authenticated users, although the record's CVSS vector shows no privileges required. Treat accounts as a risk.
What is the fixed version?
DataEase 2.10.9, according to the advisory.
Sources
Last reviewed: 18 October 2026.
