{"id":"CVE-2026-123280","kind":"vulnerability","aliases":["CVE-2026-123280"],"related":[],"title":"JetBrains Datalore: unauthenticated users can execute code via published reports","description":"In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports","summary":"Before version 2026.2.4, JetBrains Datalore let unauthenticated users run code through published interactive reports. An attacker who can reach a published report can execute code on the Datalore server.","severity":"high","cvss":8.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["datalore","jetbrains","other","self-hosted"],"not_affected_if":["no-published-reports","version-2026.2.4-or-later"],"how_to_check":"- Check the installed Datalore version against `2026.2.4`.\n- Confirm whether your Datalore instance publishes interactive reports to unauthenticated viewers.","fix":"- Move Datalore to `2026.2.4` or later.","status":"open","published_at":"2026-11-06T11:17:06+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","triaged_at":"2026-11-06T11:41:57+00:00","updated_at":"2026-11-06T11:41:57+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T11:41:57Z","model":"claude-haiku-5-5","output":{"fix":"- Move Datalore to `2026.2.4` or later.","reach":"internet","title":"JetBrains Datalore: unauthenticated users can execute code via published reports","impact":"high","summary":"Before version 2026.2.4, JetBrains Datalore let unauthenticated users run code through published interactive reports. An attacker who can reach a published report can execute code on the Datalore server.","audience":"businesses","category":"other","nicknames":[],"who_cares":["datalore","self-hosted","jetbrains"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Code runs on the Datalore server for unauthenticated attackers.","analyst_note":"Confirm the affected version range and whether published reports are required; check the JetBrains advisory at the NVD link.","how_to_check":"- Check the installed Datalore version against `2026.2.4`.\n- Confirm whether your Datalore instance publishes interactive reports to unauthenticated viewers.","plain_action":"","needs_analyst":true,"not_affected_if":["version-2026.2.4-or-later","no-published-reports"],"who_is_affected":"Teams that self-host JetBrains Datalore older than 2026.2.4 and publish interactive reports. Instances without published reports, or on a later version, are not affected by this description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000661,"input_tokens":4161,"output_tokens":489,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123280':13A,16A '-2026':12A,15A '2026.2.4':25B,56C 'attack':38B 'code':7A,32B,47B,61C 'could':59C 'cve':11A,14A 'datalor':2A,17B,27B,50B,54C 'execut':6A,46B,60C 'host':22B 'interact':35B,64C 'jetbrain':1A,18B,26B,53C 'let':28B 'publish':9A,34B,43B,63C 'reach':41B 'report':10A,36B,44B,65C 'run':31B 'self':21B 'self-host':20B 'server':51B 'unauthent':3A,29B,57C 'user':4A,30B,58C 'version':24B 'via':8A,62C","nicknames":[],"mitigations":[],"who_affected":"Teams that self-host JetBrains Datalore older than 2026.2.4 and publish interactive reports. Instances without published reports, or on a later version, are not affected by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["datalore","high","jetbrains","other","selfhosted"],"campaign_type":null,"search_a":"'-123280':13A,16A '-2026':12A,15A 'code':7A 'cve':11A,14A 'datalor':2A 'execut':6A 'jetbrain':1A 'publish':9A 'report':10A 'unauthent':3A 'user':4A 'via':8A","search_b":"'2026.2.4':25B 'attack':38B 'code':32B,47B 'datalor':17B,27B,50B 'execut':46B 'host':22B 'interact':35B 'jetbrain':18B,26B 'let':28B 'publish':34B,43B 'reach':41B 'report':36B,44B 'run':31B 'self':21B 'self-host':20B 'server':51B 'unauthent':29B 'user':30B 'version':24B","search_c":"'2026.2.4':56C 'code':61C 'could':59C 'datalor':54C 'execut':60C 'interact':64C 'jetbrain':53C 'publish':63C 'report':65C 'unauthent':57C 'user':58C 'via':62C","first_public_at":"2026-11-06T11:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123280","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123280","severity":null,"published_at":"2026-11-06T11:17:06+00:00","modified_at":"2026-11-06T11:17:06+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","fetched_at":"2026-11-06T11:41:24+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}