CVE-2026-123286: JetBrains Datalore: improper authz exposes storage token

MEDIUM

Published November 6, 2026

CISO Take

CVE-2026-123286 is an improper authorization flaw (CWE-863) in JetBrains Datalore, a hosted data-science notebook platform, before version 2026.4 that lets a low-privileged user read the notebook owner's file storage session token. The impact is rated medium (CVSS 5.9) because exploitation needs high attack complexity, but the confidentiality impact is high: a stolen token can expose datasets, models and other artifacts held in the connected storage. There is no CISA KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so there is no evidence of active exploitation, but credential-theft flaws like this are cheap to use once understood. Upgrade Datalore to 2026.4 or later, rotate any file storage tokens that may have been exposed, and review storage access logs for use of tokens from unexpected sources. Prioritize shared or multi-tenant Datalore deployments, where the owner and the attacker are different people.

Sources:NVDjetbrains.comATLAS

What is the risk?

Medium overall. The attack is network-reachable and needs no user interaction, but it requires a low-privileged account and high attack complexity, which limits opportunistic exploitation. Confidentiality impact is high and integrity impact is low, because the stolen token may allow limited changes to the storage. No exploitation is known: no KEV listing, public exploit or scanner template, and the EPSS score is unavailable. Risk rises sharply in shared Datalore instances where notebook owners hold tokens for storage containing sensitive training data or proprietary models. Package data is sparse (dependents unknown, no other CVEs tracked).

How does the attack unfold?

Initial Access

Attacker authenticates to a shared Datalore instance with a low-privileged account.

AML.T0012

Credential Exposure

Attacker exploits the improper authorization check to read the notebook owner's file storage session token.

AML.T0055

Token Reuse

Attacker replays the stolen token to authenticate to the connected file storage as the owner.

AML.T0091.000

Impact

Attacker exfiltrates datasets and model artifacts, and may modify stored files.

AML.T0035

Initial Access

Attacker authenticates to a shared Datalore instance with a low-privileged account.

AML.T0012

Credential Exposure

Attacker exploits the improper authorization check to read the notebook owner's file storage session token.

AML.T0055

Token Reuse

Attacker replays the stolen token to authenticate to the connected file storage as the owner.

AML.T0091.000

Impact

Attacker exfiltrates datasets and model artifacts, and may modify stored files.

AML.T0035

How severe is it?

CVSS 3.1

5.9 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AVNetwork

ACHigh

PRLow

UINone

SUnchanged

CHigh

ILow

ANone

What should I do?

1 step

1) Upgrade JetBrains Datalore to version 2026.4 or later. 2) Rotate file storage session tokens and credentials for all notebook owners, especially on shared instances. 3) Restrict notebook sharing and collaborator permissions to trusted users until patched. 4) Review storage access logs for token use from unusual IP addresses, user agents or times. 5) Apply least-privilege scopes and short token lifetimes to storage integrations. 6) Track the JetBrains security advisory page (jetbrains.com/privacy-security/issues-fixed) for updates.

How is it classified?

Auth BypassData LeakageData ExtractionFrameworkTraining DataAML.T0035- AI Artifact Collection AML.T0055- Unsecured Credentials AML.T0091.000- Application Access Token

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Article 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.2-Data for development and enhancement of AI system

NIST AI RMF

MANAGE 2.3-Responses to previously unknown risks and incidents

Frequently Asked Questions

What is CVE-2026-123286?

Is CVE-2026-123286 actively exploited?

No confirmed active exploitation of CVE-2026-123286 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-123286?

1) Upgrade JetBrains Datalore to version 2026.4 or later. 2) Rotate file storage session tokens and credentials for all notebook owners, especially on shared instances. 3) Restrict notebook sharing and collaborator permissions to trusted users until patched. 4) Review storage access logs for token use from unusual IP addresses, user agents or times. 5) Apply least-privilege scopes and short token lifetimes to storage integrations. 6) Track the JetBrains security advisory page (jetbrains.com/privacy-security/issues-fixed) for updates.

What systems are affected by CVE-2026-123286?

This vulnerability affects the following AI/ML architecture patterns: Hosted notebook environments, Training pipelines, Data science workspaces, Model development workflows.

What is the CVSS score for CVE-2026-123286?

CVE-2026-123286 has a CVSS v3.1 base score of 5.9 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

Hosted notebook environmentsTraining pipelinesData science workspacesModel development workflows

MITRE ATLAS Techniques

AML.T0035AI Artifact Collection

AML.T0055Unsecured Credentials

AML.T0091.000Application Access Token

Compliance Controls Affected

EU AI Act: Article 15

ISO 42001: A.7.2

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token

Exploitation Scenario

An attacker with a low-privileged account on a shared Datalore server, such as a collaborator or viewer on a team workspace, finds the authorization gap that exposes the notebook owner's file storage session token. After meeting the timing or state conditions the high complexity requires, they retrieve the token and use it to access the owner's file storage. They download proprietary datasets and model artifacts, and may alter stored files to poison later training runs or plant backdoored data.

Weaknesses (CWE)

CWE-863Incorrect AuthorizationPrimary CWE-863Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.