CVE-2026-123279: JetBrains Datalore: view-only users can run notebook code

CRITICAL

Published November 6, 2026

CISO Take

CVE-2026-123279 is an authorization flaw in JetBrains Datalore, a collaborative data science notebook platform. Before version 2026.4, a collaborator with view-only access could still trigger code execution in a notebook's computation. The CVSS score is 9.0 (critical), with a scope change that lets code run beyond the permission boundary of the sharing model. There is no KEV listing, no public exploit, no Nuclei template and no EPSS data yet, so active exploitation is not evidenced, but the attack needs only a low-privileged account and one user interaction. Upgrade Datalore to 2026.4 or later, then audit notebook sharing lists for view-only users who should not have access, and review the credentials and data connections attached to shared notebooks.

Sources:NVDjetbrains.com

What is the risk?

Severity is critical (CVSS 3.1 base 9.0, AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H). The weakness is CWE-863 (incorrect authorization): the permission model fails to separate view and execute rights. Exploitation needs only a low-privilege account, such as a view-only invitee, and one user interaction. EPSS, SSVC and package risk data are unavailable. The CVE is not in CISA KEV and no public exploit or scanner template is known, so near-term mass exploitation looks unlikely. Risk is highest for organisations that share notebooks widely with external or low-trust collaborators. The scope change means compromise can reach the host environment, attached data sources and secrets, not only the notebook.

How does the attack unfold?

Initial Access

Attacker gains view-only collaborator access to a shared Datalore notebook through an invitation or a compromised low-privilege account.

AML.T0012

Exploitation

Attacker triggers notebook computation despite view-only rights, bypassing the authorization check (CWE-863).

AML.T0049

Code Execution

Arbitrary code runs in the notebook's computation environment with the permissions of the notebook workspace.

AML.T0050

Impact

Attacker steals credentials and sensitive data, or tampers with datasets and models used downstream.

AML.T0025

Initial Access

Attacker gains view-only collaborator access to a shared Datalore notebook through an invitation or a compromised low-privilege account.

AML.T0012

Exploitation

Attacker triggers notebook computation despite view-only rights, bypassing the authorization check (CWE-863).

AML.T0049

Code Execution

Arbitrary code runs in the notebook's computation environment with the permissions of the notebook workspace.

AML.T0050

Impact

Attacker steals credentials and sensitive data, or tampers with datasets and models used downstream.

AML.T0025

How severe is it?

CVSS 3.1

9.0 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UIRequired

SChanged

CHigh

IHigh

AHigh

What should I do?

1 step

1) Upgrade JetBrains Datalore (cloud or on-premises) to 2026.4 or later, per the JetBrains security advisory. 2) Until patched, remove view-only collaborators from sensitive notebooks, disable external sharing and restrict who can open shared links. 3) Rotate secrets, tokens and database credentials stored in or reachable from shared notebooks. 4) Run notebook computation in isolated, least-privilege environments with restricted egress and no ambient cloud credentials. 5) Detection: review audit logs for code execution or computation start events by users holding view-only roles, and watch for unexpected outbound connections or new processes from notebook workers.

How is it classified?

Auth BypassCode ExecutionData LeakageFrameworkTraining DataAML.T0012- Valid Accounts AML.T0049- Exploit Public-Facing Application AML.T0050- Command and Scripting Interpreter

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

8.1-Operational planning and control

NIST AI RMF

GOVERN 6.1-Policies and procedures address AI risks associated with third-party entities

Frequently Asked Questions

What is CVE-2026-123279?

Is CVE-2026-123279 actively exploited?

No confirmed active exploitation of CVE-2026-123279 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-123279?

1) Upgrade JetBrains Datalore (cloud or on-premises) to 2026.4 or later, per the JetBrains security advisory. 2) Until patched, remove view-only collaborators from sensitive notebooks, disable external sharing and restrict who can open shared links. 3) Rotate secrets, tokens and database credentials stored in or reachable from shared notebooks. 4) Run notebook computation in isolated, least-privilege environments with restricted egress and no ambient cloud credentials. 5) Detection: review audit logs for code execution or computation start events by users holding view-only roles, and watch for unexpected outbound connections or new processes from notebook workers.

What systems are affected by CVE-2026-123279?

This vulnerability affects the following AI/ML architecture patterns: Collaborative notebook platforms, ML training pipelines, Data science workspaces, Model development environments, Shared analytics and feature engineering notebooks.

What is the CVSS score for CVE-2026-123279?

CVE-2026-123279 has a CVSS v3.1 base score of 9.0 (CRITICAL).

What is the AI security impact?

Affected AI Architectures

Collaborative notebook platformsML training pipelinesData science workspacesModel development environmentsShared analytics and feature engineering notebooks

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0049Exploit Public-Facing Application

AML.T0050Command and Scripting Interpreter

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: 8.1

NIST AI RMF: GOVERN 6.1

What are the technical details?

Original Advisory

In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators

Exploitation Scenario

An attacker obtains a low-privilege account, for example through an invitation as a view-only collaborator on a shared analytics notebook or a compromised reader account. They open the notebook, which requires user interaction, and trigger a computation that the permission model should block. Their payload runs in the notebook's computation environment. It reads environment variables and connection settings to harvest database and cloud credentials, queries connected data warehouses for sensitive training data, and may modify notebook cells or data to poison downstream model training. They can then pivot from the compute host to internal resources.

Weaknesses (CWE)

CWE-863Incorrect AuthorizationPrimary CWE-863Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.