AI Threat AlertCVE-2026-123287: JetBrains Datalore: unauthenticated download of private notebooks
MEDIUMJetBrains Datalore, a hosted data science notebook platform, contains an authorization flaw (CWE-863) that lets an unauthenticated attacker download private notebook files through published interactive reports. The CVSS score is a moderate 5.9, held down by high attack complexity, but the confidentiality impact is rated high because notebooks routinely embed credentials, API keys, connection strings, proprietary datasets and model code. There is no CISA KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so there is no evidence of active exploitation today. Upgrade Datalore to 2026.4 or later, and until then audit which interactive reports are published and unpublish any that are not needed. Rotate any secrets stored in notebooks that were exposed through published reports.
What is the risk?
Overall risk is medium. Exploitation needs no privileges and no user interaction over the network, but the high attack complexity (likely the need to identify published reports and their link structure) limits easy mass exploitation. Impact is confined to confidentiality, with no integrity or availability effects. Risk rises sharply for organizations whose notebooks hold hardcoded credentials, sensitive training data or proprietary model logic, and for instances with many publicly published reports. Exposure data (dependents, scorecard, EPSS) is unavailable, so the assessment relies on the vendor's CVSS vector and description.
How does the attack unfold?
What systems are affected?
| Package | Ecosystem | Vulnerable Range | Patched |
|---|---|---|---|
| Jupyter | pip | — | No patch |
Do you use Jupyter? You're affected.
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade Datalore to version 2026.4 or later per the JetBrains security advisory (jetbrains.com/privacy-security/issues-fixed). 2) Until patched, unpublish or restrict interactive reports, especially those tied to notebooks containing sensitive content. 3) Review access logs for unauthenticated requests to notebook file download endpoints and published report paths. 4) Rotate API keys, tokens, database passwords and cloud credentials stored in or referenced by notebooks associated with published reports. 5) Adopt a secrets manager and environment variables rather than hardcoding secrets in notebooks. 6) Check whether sensitive datasets or PII were embedded in the exposed notebooks and assess notification obligations.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-123287?
JetBrains Datalore, a hosted data science notebook platform, contains an authorization flaw (CWE-863) that lets an unauthenticated attacker download private notebook files through published interactive reports. The CVSS score is a moderate 5.9, held down by high attack complexity, but the confidentiality impact is rated high because notebooks routinely embed credentials, API keys, connection strings, proprietary datasets and model code. There is no CISA KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so there is no evidence of active exploitation today. Upgrade Datalore to 2026.4 or later, and until then audit which interactive reports are published and unpublish any that are not needed. Rotate any secrets stored in notebooks that were exposed through published reports.
Is CVE-2026-123287 actively exploited?
No confirmed active exploitation of CVE-2026-123287 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-123287?
1) Upgrade Datalore to version 2026.4 or later per the JetBrains security advisory (jetbrains.com/privacy-security/issues-fixed). 2) Until patched, unpublish or restrict interactive reports, especially those tied to notebooks containing sensitive content. 3) Review access logs for unauthenticated requests to notebook file download endpoints and published report paths. 4) Rotate API keys, tokens, database passwords and cloud credentials stored in or referenced by notebooks associated with published reports. 5) Adopt a secrets manager and environment variables rather than hardcoding secrets in notebooks. 6) Check whether sensitive datasets or PII were embedded in the exposed notebooks and assess notification obligations.
What systems are affected by CVE-2026-123287?
This vulnerability affects the following AI/ML architecture patterns: Training pipelines, Data science notebook platforms, Experiment tracking and prototyping environments, Model development workflows.
What is the CVSS score for CVE-2026-123287?
CVE-2026-123287 has a CVSS v3.1 base score of 5.9 (MEDIUM).
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0035AI Artifact CollectionAML.T0036Data from Information RepositoriesAML.T0049Exploit Public-Facing ApplicationCompliance Controls Affected
What are the technical details?
Original Advisory
In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports
Exploitation Scenario
An attacker finds a publicly shared Datalore interactive report URL belonging to a data science team, through search engines, shared links or enumeration. Without logging in, they request the underlying private notebook file through the report's flawed authorization path and download it. The notebook contains hardcoded cloud storage keys, a database connection string for the feature store and the proprietary preprocessing and model training code. The attacker uses the credentials to access training data and model artifacts, stealing intellectual property and potentially poisoning or exfiltrating datasets.
Weaknesses (CWE)
CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
- [Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- [Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NTimeline
Related Vulnerabilities
CVE-2023-2557410.0JupyterHub LTI13: JWT forgery enables full auth bypass
Same package: jupyterCVE-2024-3970010.0JupyterLab extension-template: CI workflow RCE
Same package: jupyterCVE-2026-441809.8Jupyter Enterprise Gateway: root privilege bypass in Kubernetes
Same package: jupyterCVE-2026-235379.1Feast: unauth file write to RCE via /save-document
Same package: jupyterCVE-2026-545279.0jupyterlab-git: stored XSS escalates to full RCE
Same package: jupyter