CVE-2026-123281 · Other
NO FIX YET · SEE WHAT TO DO
In JetBrains Datalore before 2026.4, code run in a notebook could execute commands in the sidecar container through the mount broker. The sources give no further detail on the attack path.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running Datalore before 2026.4 in their own environment, where notebook code runs in a sidecar container with a mount broker. Sources do not describe further conditions, so unknown beyond that version range.
Not affected if version-2026.4-or-later
Who cares datalore, jetbrains, self-hosted
2026.42026.4 or later (per the advisory summary; confirm against the vendor page)In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.