{"id":"CVE-2026-123282","kind":"vulnerability","aliases":["CVE-2026-123282"],"related":[],"title":"JetBrains Datalore: expired account tokens still open new sessions","description":"In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session","summary":"JetBrains Datalore before 2026.4 did not check whether account tokens had expired. An attacker holding an old token could start a new authenticated session.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["datalore","jetbrains","self-hosted","vendor"],"not_affected_if":["version-2026.4-or-later"],"how_to_check":"- Check the installed Datalore version against the fixed release `2026.4`.","fix":"- Datalore: move to `2026.4` or later.","status":"open","published_at":"2026-11-06T11:17:06+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","triaged_at":"2026-11-06T11:42:09+00:00","updated_at":"2026-11-06T11:42:09+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-06T11:42:09Z","model":"claude-haiku-5-5","output":{"fix":"- Datalore: move to `2026.4` or later.","reach":"network","title":"JetBrains Datalore: expired account tokens still open new sessions","impact":"medium","summary":"JetBrains Datalore before 2026.4 did not check whether account tokens had expired. An attacker holding an old token could start a new authenticated session.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["datalore","self-hosted","jetbrains"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"attacker reuses an expired token to gain a new session","analyst_note":"Confirm from the JetBrains advisory whether hosted Datalore is affected and what the fixed version is.","how_to_check":"- Check the installed Datalore version against the fixed release `2026.4`.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["version-2026.4-or-later"],"who_is_affected":"Organisations running a self-hosted Datalore server before 2026.4 are affected. Hosted use by the vendor is not described in the sources. The sources do not say which token types or deployment settings are needed to exploit it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000647,"input_tokens":4165,"output_tokens":460,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123282':12A,15A '-2026':11A,14A '2026.4':25B,50C 'account':4A,30B,55C 'allow':57C 'attack':35B 'authent':44B,60C 'check':28B 'could':40B 'cve':10A,13A 'datalor':2A,16B,23B,48C 'expir':3A,33B,52C 'hold':36B 'host':20B 'jetbrain':1A,17B,22B,47C 'miss':51C 'new':8A,43B,59C 'old':38B 'open':7A 'self':19B 'self-host':18B 'session':9A,45B,61C 'start':41B 'still':6A 'token':5A,31B,39B,56C 'valid':53C 'vendor':21B 'whether':29B","nicknames":[],"mitigations":[],"who_affected":"Organisations running a self-hosted Datalore server before 2026.4 are affected. Hosted use by the vendor is not described in the sources. The sources do not say which token types or deployment settings are needed to exploit it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["datalore","high","jetbrains","selfhosted","vendor"],"campaign_type":null,"search_a":"'-123282':12A,15A '-2026':11A,14A 'account':4A 'cve':10A,13A 'datalor':2A 'expir':3A 'jetbrain':1A 'new':8A 'open':7A 'session':9A 'still':6A 'token':5A","search_b":"'2026.4':25B 'account':30B 'attack':35B 'authent':44B 'check':28B 'could':40B 'datalor':16B,23B 'expir':33B 'hold':36B 'host':20B 'jetbrain':17B,22B 'new':43B 'old':38B 'self':19B 'self-host':18B 'session':45B 'start':41B 'token':31B,39B 'vendor':21B 'whether':29B","search_c":"'2026.4':50C 'account':55C 'allow':57C 'authent':60C 'datalor':48C 'expir':52C 'jetbrain':47C 'miss':51C 'new':59C 'session':61C 'token':56C 'valid':53C","first_public_at":"2026-11-06T11:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123282","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123282","severity":null,"published_at":"2026-11-06T11:17:06+00:00","modified_at":"2026-11-06T11:17:06+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","fetched_at":"2026-11-06T11:41:24+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}