---
id: "CVE-2026-123287"
page: "https://infrastack.ai/live/CVE-2026-123287"
kind: "vulnerability"
aliases: ["CVE-2026-123287"]
title: "JetBrains Datalore: private notebook files downloadable without authentication"
severity: "medium"
cvss: 5.9
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["datalore", "jetbrains", "other", "self-hosted"]
not_affected_if: ["no-published-reports", "version-2026.4-or-later"]
published_at: "2026-11-06T11:17:07+00:00"
first_seen_at: "2026-11-06T11:41:24+00:00"
updated_at: "2026-11-06T11:42:23+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123287", "first_seen_at": "2026-11-06T11:41:24+00:00"}]
exploit_sources: []
---

# JetBrains Datalore: private notebook files downloadable without authentication

Link for people: https://infrastack.ai/live/CVE-2026-123287 (this .md is for agents)

In JetBrains Datalore before 2026.4, private notebook files could be downloaded by anyone through published interactive reports. An attacker with no account can read notebook contents that were meant to stay private.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Datalore version against the fixed version stated in the advisory, `2026.4`.
- Check whether any interactive reports are published from Datalore notebooks, since the flaw runs through published reports.

## Fix

- Move Datalore to `2026.4` or later.

## Timeline

- 2026-11-06T11:41:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123287

## From the sources

In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_