{"id":"CVE-2026-123281","kind":"vulnerability","aliases":["CVE-2026-123281"],"related":[],"title":"JetBrains Datalore: notebook code can run commands in sidecar container","description":"In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker","summary":"In JetBrains Datalore before 2026.4, code run in a notebook could execute commands in the sidecar container through the mount broker. The sources give no further detail on the attack path.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["datalore","jetbrains","other","self-hosted"],"not_affected_if":["version-2026.4-or-later"],"how_to_check":"- Check the installed Datalore version against `2026.4`","fix":"- Datalore: move to `2026.4` or later (per the advisory summary; confirm against the vendor page)","status":"open","published_at":"2026-11-06T11:17:06+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","triaged_at":"2026-11-06T11:42:06+00:00","updated_at":"2026-11-06T11:42:06+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-11-06T11:42:06Z","model":"claude-haiku-5-5","output":{"fix":"- Datalore: move to `2026.4` or later (per the advisory summary; confirm against the vendor page)","reach":"unknown","title":"JetBrains Datalore: notebook code can run commands in sidecar container","impact":"high","summary":"In JetBrains Datalore before 2026.4, code run in a notebook could execute commands in the sidecar container through the mount broker. The sources give no further detail on the attack path.","audience":"businesses","category":"other","nicknames":[],"who_cares":["datalore","jetbrains","self-hosted"],"confidence":0.4,"fix_status":"available","needs_auth":"unknown","worst_case":"notebook code runs commands inside the sidecar container","analyst_note":"Confirm the fixed version and attack preconditions on the JetBrains Datalore security advisory; the only source is NVD with a one-line description.","how_to_check":"- Check the installed Datalore version against `2026.4`\n- unknown","plain_action":"","needs_analyst":true,"not_affected_if":["version-2026.4-or-later"],"who_is_affected":"Teams running Datalore before 2026.4 in their own environment, where notebook code runs in a sidecar container with a mount broker. Sources do not describe further conditions, so unknown beyond that version range.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000656,"input_tokens":4165,"output_tokens":478,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123281':13A,16A '-2026':12A,15A '2026.4':27B,58C 'attack':52B 'broker':43B,71C 'code':4A,28B,60C 'command':7A,35B,63C 'contain':10A,39B,67C 'could':33B,61C 'cve':11A,14A 'datalor':2A,17B,25B,56C 'detail':49B 'execut':34B,62C 'give':46B 'host':22B 'jetbrain':1A,18B,24B,55C 'mount':42B,70C 'notebook':3A,32B,59C 'path':53B 'run':6A,29B 'self':21B 'self-host':20B 'sidecar':9A,38B,66C 'sourc':45B 'via':68C","nicknames":[],"mitigations":[],"who_affected":"Teams running Datalore before 2026.4 in their own environment, where notebook code runs in a sidecar container with a mount broker. Sources do not describe further conditions, so unknown beyond that version range.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["datalore","high","jetbrains","other","selfhosted"],"campaign_type":null,"search_a":"'-123281':13A,16A '-2026':12A,15A 'code':4A 'command':7A 'contain':10A 'cve':11A,14A 'datalor':2A 'jetbrain':1A 'notebook':3A 'run':6A 'sidecar':9A","search_b":"'2026.4':27B 'attack':52B 'broker':43B 'code':28B 'command':35B 'contain':39B 'could':33B 'datalor':17B,25B 'detail':49B 'execut':34B 'give':46B 'host':22B 'jetbrain':18B,24B 'mount':42B 'notebook':32B 'path':53B 'run':29B 'self':21B 'self-host':20B 'sidecar':38B 'sourc':45B","search_c":"'2026.4':58C 'broker':71C 'code':60C 'command':63C 'contain':67C 'could':61C 'datalor':56C 'execut':62C 'jetbrain':55C 'mount':70C 'notebook':59C 'sidecar':66C 'via':68C","first_public_at":"2026-11-06T11:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123281","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123281","severity":null,"published_at":"2026-11-06T11:17:06+00:00","modified_at":"2026-11-06T11:17:06+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","fetched_at":"2026-11-06T11:41:24+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}