CVE-2026-40901

CVE-2026-40901 affects DataEase, an open-source data visualization platform, in versions 2.10.20 and earlier. The vulnerability stems from unsafe Java deserialization in the bundled Quartz scheduler library, which deserializes job data from the database without filtering or validation. An authenticated attacker with database write access can inject a malicious CommonsCollections6 gadget chain payload into scheduled job configurations, leading to arbitrary command execution with root privileges when the cron trigger fires. The vulnerability carries a CVSS score of 8.8 (HIGH) with a network attack vector, low complexity, and requirement for low privilege authentication. Successful exploitation results in complete compromise of confidentiality, integrity, and availability, with the attacker gaining root-level code execution within the container environment. The attack chain leverages legacy deserialization gadgets present in bundled velocity and commons-collections libraries. There is currently no evidence of active exploitation in the wild, and the vulnerability is not present on the CISA Known Exploited Vulnerabilities list. Community attention remains minimal, with an EPSS score of 0.0035 indicating very low prevalence of exploitation attempts. The issue has been remediated in version 2.10.21, and organizations running affected versions should prioritize patching to eliminate the deserialization gadget chains.