CVE-2026-123290 · Vendor
NO FIX YET · SEE WHAT TO DO
In JetBrains Datalore before 2026.4, code that was hidden in a notebook was returned to unauthenticated users through the public interactive report content endpoint. An attacker can read notebook code that the author meant to keep out of view.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run Datalore and publish interactive reports through its public endpoint are exposed. Installations that do not publish interactive reports, or that run a release at or after 2026.4, are not affected. The sources do not say which report settings or configurations make the public endpoint reachable.
Not affected if fixed-version, no-public-reports
Who cares datalore, jetbrains, self-hosted
Unknown from the sources.
In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.