CVE-2026-123290: JetBrains Datalore: hidden notebook code exposed unauthenticated

MEDIUM

Published November 6, 2026

CISO Take

JetBrains Datalore, a hosted notebook platform for data science, exposed hidden notebook code to unauthenticated users through its public interactive report content endpoint in versions before 2026.4. The flaw is a network-reachable information disclosure (CWE-201) that needs no credentials or user interaction, but it only leaks confidentiality at low impact (CVSS 5.3) and nothing suggests broader compromise. There is no KEV listing, no public exploit, no Nuclei template and no EPSS score yet, so mass exploitation looks unlikely today. The real risk is that code authors deliberately hid, such as embedded API keys, connection strings, proprietary feature logic or model details, could be read by anyone who finds a shared report link. Upgrade Datalore to 2026.4 or later, audit every published interactive report for secrets in hidden cells, and rotate any credentials that were embedded in them.

Sources:NVDATLASjetbrains.com

What is the risk?

Medium. Exploitation is trivial (network, low complexity, no privileges, no user interaction), but the impact is limited to confidentiality of the hidden code (C:L). The attacker needs the URL of a public interactive report, which narrows exposure to organizations that publish reports externally. No KEV listing, public exploit, scanner template or EPSS data was available at publication. Severity rises sharply if hidden cells contain credentials, tokens or proprietary model and data-pipeline logic.

How does the attack unfold?

Discovery

Attacker locates a public interactive report URL on a Datalore instance.

AML.T0006

Exploitation

Attacker requests the public report content endpoint without authentication and receives hidden notebook code.

AML.T0049

Collection

Attacker extracts secrets, data-source details and proprietary logic from the exposed hidden cells.

AML.T0036

Impact

Attacker uses the stolen credentials to reach data stores or reuses the leaked intellectual property.

AML.T0055

Discovery

Attacker locates a public interactive report URL on a Datalore instance.

AML.T0006

Exploitation

Attacker requests the public report content endpoint without authentication and receives hidden notebook code.

AML.T0049

Collection

Attacker extracts secrets, data-source details and proprietary logic from the exposed hidden cells.

AML.T0036

Impact

Attacker uses the stolen credentials to reach data stores or reuses the leaked intellectual property.

AML.T0055

How severe is it?

CVSS 3.1

5.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CLow

INone

ANone

What should I do?

1 step

1) Upgrade JetBrains Datalore to 2026.4 or later (see the JetBrains 'issues fixed' page). 2) Inventory all published or shared interactive reports and unpublish any that are not needed. 3) Review hidden cells for hardcoded secrets and rotate any API keys, database passwords or cloud tokens found there. 4) Move secrets to a secrets manager or environment-level connection settings rather than notebook cells. 5) Check web and proxy logs for unauthenticated requests to the public report content endpoint from unknown IPs, especially before patching. 6) Where patching is delayed, restrict public report sharing or place the Datalore instance behind authentication or an IP allowlist.

How is it classified?

Data LeakageAuth BypassFrameworkAML.T0036- Data from Information Repositories AML.T0049- Exploit Public-Facing Application AML.T0055- Unsecured Credentials

Which compliance frameworks are affected?

This CVE is relevant to:

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Responses to identified AI risks are developed and applied

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-123290?

Is CVE-2026-123290 actively exploited?

No confirmed active exploitation of CVE-2026-123290 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-123290?

1) Upgrade JetBrains Datalore to 2026.4 or later (see the JetBrains 'issues fixed' page). 2) Inventory all published or shared interactive reports and unpublish any that are not needed. 3) Review hidden cells for hardcoded secrets and rotate any API keys, database passwords or cloud tokens found there. 4) Move secrets to a secrets manager or environment-level connection settings rather than notebook cells. 5) Check web and proxy logs for unauthenticated requests to the public report content endpoint from unknown IPs, especially before patching. 6) Where patching is delayed, restrict public report sharing or place the Datalore instance behind authentication or an IP allowlist.

What systems are affected by CVE-2026-123290?

This vulnerability affects the following AI/ML architecture patterns: Hosted notebook environments, Data science and training pipelines, ML experiment reporting and dashboards.

What is the CVSS score for CVE-2026-123290?

CVE-2026-123290 has a CVSS v3.1 base score of 5.3 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

Hosted notebook environmentsData science and training pipelinesML experiment reporting and dashboards

MITRE ATLAS Techniques

AML.T0036Data from Information Repositories

AML.T0049Exploit Public-Facing Application

AML.T0055Unsecured Credentials

Compliance Controls Affected

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint

Exploitation Scenario

An attacker finds a public interactive report link for a Datalore instance, for example through a shared dashboard, search indexing or a leaked URL. They request the public interactive report content endpoint without authenticating and receive the full notebook content, including cells the author marked as hidden. In those cells they find a cloud storage key and a database connection string used to load training data. They use the credentials to reach the data store, copy proprietary datasets, and learn the feature engineering logic for the organization's models.

Weaknesses (CWE)

CWE-201Insertion of Sensitive Information Into Sent DataPrimary CWE-201Insertion of Sensitive Information Into Sent Data

CWE-201 — Insertion of Sensitive Information Into Sent Data: The code transmits data to another actor, but a portion of the data includes sensitive information that should not be accessible to that actor.

[Requirements] Specify which data in the software should be regarded as sensitive. Consider which types of users should have access to which types of data.
[Implementation] Ensure that any possibly sensitive data specified in the requirements is verified with designers to ensure that it is either a calculated risk or mitigated elsewhere. Any information that is not necessary to the functionality should be removed in order to lower both the overhead and the possibility of security sensitive data being sent.

Source: MITRE CWE corpus.