CVE-2026-123289: JetBrains Datalore: improper authorization lets viewers edit files

MEDIUM

Published November 6, 2026

CISO Take

JetBrains Datalore, a collaborative data science notebook platform, has an improper authorization flaw (CWE-863) before version 2026.4 that lets users with only notebook viewer rights modify files. It is rated medium (CVSS 5.4) and needs only a low-privileged authenticated account over the network, with no user interaction. There is no KEV listing, no public exploit, no Nuclei template and no EPSS data, so there is no sign of active exploitation. The practical risk is integrity loss in shared notebooks: viewers could alter data files, scripts or configs that analysts and ML pipelines trust. Upgrade Datalore to 2026.4 or later, review who holds viewer access on sensitive workspaces, and audit recent file changes for edits that don't match authorized editors.

Sources:NVDjetbrains.comATLAS

What is the risk?

Medium overall. The attack is network-reachable, low complexity, needs low privileges and no user interaction (AV:N/AC:L/PR:L/UI:N). Impact is limited to low integrity and low availability, with no confidentiality loss. No exploitation signals exist: not in CISA KEV, no public exploit, no scanner template, and EPSS and SSVC are unavailable. Exposure is highest in multi-tenant or broadly shared Datalore deployments where many people hold viewer access. Package-level signals are absent (0 other CVEs, risk score 0/100, dependents unknown), so blast radius cannot be quantified from the data available.

How does the attack unfold?

Initial Access

Attacker holds or obtains a low-privileged viewer account on a shared Datalore notebook.

AML.T0012

Exploitation

Attacker sends file-modification requests that bypass the viewer-only permission check (CWE-863).

Impact

Shared datasets, scripts or configs are altered, corrupting analysis and downstream ML inputs.

AML.T0059

Initial Access

Attacker holds or obtains a low-privileged viewer account on a shared Datalore notebook.

AML.T0012

Exploitation

Attacker sends file-modification requests that bypass the viewer-only permission check (CWE-863).

Impact

Shared datasets, scripts or configs are altered, corrupting analysis and downstream ML inputs.

AML.T0059

How severe is it?

CVSS 3.1

5.4 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CNone

ILow

ALow

What should I do?

1 step

1) Upgrade JetBrains Datalore to version 2026.4 or later, per the vendor advisory at jetbrains.com/privacy-security/issues-fixed/. 2) Until patched, minimize the number of viewer accounts on sensitive notebooks and workspaces, and remove stale or external viewers. 3) Restrict network access to the Datalore instance to trusted users or networks (VPN or SSO-gated). 4) Audit file modification logs and notebook version history for changes made by accounts with viewer-only roles. 5) Keep backups or version control of datasets and scripts used in ML pipelines so unauthorized edits can be detected and reverted. 6) Check file integrity (hashes) before data or artifacts feed training or production jobs.

How is it classified?

Auth BypassData LeakageFrameworkTraining DataAML.T0012- Valid Accounts AML.T0059- Erode Dataset Integrity

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.2-Data for development and enhancement of AI system

NIST AI RMF

MANAGE 2.3-Risk treatment and response to previously unknown risks

Frequently Asked Questions

What is CVE-2026-123289?

Is CVE-2026-123289 actively exploited?

No confirmed active exploitation of CVE-2026-123289 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-123289?

1) Upgrade JetBrains Datalore to version 2026.4 or later, per the vendor advisory at jetbrains.com/privacy-security/issues-fixed/. 2) Until patched, minimize the number of viewer accounts on sensitive notebooks and workspaces, and remove stale or external viewers. 3) Restrict network access to the Datalore instance to trusted users or networks (VPN or SSO-gated). 4) Audit file modification logs and notebook version history for changes made by accounts with viewer-only roles. 5) Keep backups or version control of datasets and scripts used in ML pipelines so unauthorized edits can be detected and reverted. 6) Check file integrity (hashes) before data or artifacts feed training or production jobs.

What systems are affected by CVE-2026-123289?

This vulnerability affects the following AI/ML architecture patterns: Collaborative data science notebooks, Training pipelines, Data preparation and analytics workspaces, ML experimentation environments.

What is the CVSS score for CVE-2026-123289?

CVE-2026-123289 has a CVSS v3.1 base score of 5.4 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

Collaborative data science notebooksTraining pipelinesData preparation and analytics workspacesML experimentation environments

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0059Erode Dataset Integrity

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.2

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files

Exploitation Scenario

An adversary, or a malicious insider, obtains a low-privileged viewer account on a shared Datalore workspace, for example through an invitation or reused credentials. They send crafted requests to the file modification endpoint, which fails to enforce viewer-only permissions. They overwrite a shared dataset or helper script used by an analytics team's notebooks. Later, analysts or scheduled jobs run the tampered files. This skews results or corrupts training data without any explicit alert.

Weaknesses (CWE)

CWE-863Incorrect AuthorizationPrimary CWE-863Incorrect Authorization

CWE-863 — Incorrect Authorization: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

[Architecture and Design] Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
[Architecture and Design] Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Source: MITRE CWE corpus.