CVE-2026-123834 · Vendor
NO FIX YET · SEE WHAT TO DO
In JetBrains Datalore before 2026.4, database tasks did not check workspace scope, so a task could use the service account of a different workspace. An attacker with access to one workspace could act with the privileges of another.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams that run a self-hosted or managed Datalore instance with multiple workspaces that use database tasks and service accounts. Single-workspace deployments with no shared service accounts are less exposed. Whether the attacker needs an existing account is not stated in the sources.
Not affected if no-database-tasks, single-workspace
Who cares datalore, jetbrains, self-hosted
2026.4 or later (from the description: fixed in 2026.4)In JetBrains Datalore before 2026.4 improper scope validation in database tasks allowed using another workspace's service account
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.