---
id: "CVE-2026-123291"
page: "https://infrastack.ai/live/CVE-2026-123291"
kind: "vulnerability"
aliases: ["CVE-2026-123291"]
title: "JetBrains Datalore: flaw lets users read other workspaces' issues and runs"
severity: "medium"
cvss: 4.3
epss: null
exploited: false
status: "open"
category: "vendor"
products: []
ecosystems: []
tags: ["datalore", "jetbrains", "self-hosted", "vendor"]
not_affected_if: ["version-2026.4-or-later"]
published_at: "2026-11-06T11:17:07+00:00"
first_seen_at: "2026-11-06T11:41:24+00:00"
updated_at: "2026-11-06T11:42:41+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123291", "first_seen_at": "2026-11-06T11:41:24+00:00"}]
exploit_sources: []
---

# JetBrains Datalore: flaw lets users read other workspaces' issues and runs

Link for people: https://infrastack.ai/live/CVE-2026-123291 (this .md is for agents)

Before version 2026.4, JetBrains Datalore did not validate workspace ownership, so one user could read another workspace's issues and notebook runs. The attacker gets read access to data belonging to other workspaces.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Datalore version against the fixed version `2026.4`.

## Fix

- JetBrains Datalore: upgrade to `2026.4` or later.

## Timeline

- 2026-11-06T11:41:24+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123291

## From the sources

In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_