CVE-2026-123291: JetBrains Datalore: IDOR exposes other workspaces' notebooks

MEDIUM

Published November 6, 2026

CISO Take

JetBrains Datalore, a hosted data science notebook platform, had an improper owner validation flaw (CWE-639, an insecure direct object reference) that let any authenticated low-privilege user read another workspace's issues and runs notebook data. The CVSS score is a moderate 4.3 with confidentiality impact only, and there is no KEV listing, no public exploit, no Nuclei template and no EPSS data, so near-term mass exploitation looks unlikely. The real concern is multi-tenant data exposure: notebooks and run outputs frequently contain proprietary datasets, model experiments, connection strings and embedded credentials. Upgrade Datalore to 2026.4 or later, and if you run a shared instance, review access logs for cross-workspace requests and rotate any secrets stored in notebooks.

Sources:NVDjetbrains.comATLAS

What is the risk?

Medium overall. Exploitation is network-based, low complexity, needs only a low-privilege account and no user interaction, so it is easy once an attacker holds any valid account. Impact is limited to confidentiality (low); there is no integrity or availability effect. Exposure is highest for multi-tenant or shared Datalore deployments where untrusted or external users hold accounts. No exploitation in the wild, public PoC or EPSS signal is currently known, and the package context data is sparse (dependents unknown, no Scorecard), so confidence in the exposure estimate is limited.

How does the attack unfold?

Initial Access

Attacker signs in to a Datalore instance with any valid low-privilege account.

AML.T0012

Exploitation

Attacker requests issues and run notebook resources using identifiers from another workspace, bypassing the missing owner validation.

Collection

Server returns the foreign workspace's issues and notebook run content, which the attacker harvests for code, data references and secrets.

AML.T0036

Impact

Exposed proprietary experiments and embedded credentials enable data theft and follow-on access to connected data stores.

Initial Access

Attacker signs in to a Datalore instance with any valid low-privilege account.

AML.T0012

Exploitation

Attacker requests issues and run notebook resources using identifiers from another workspace, bypassing the missing owner validation.

Collection

Server returns the foreign workspace's issues and notebook run content, which the attacker harvests for code, data references and secrets.

AML.T0036

Impact

Exposed proprietary experiments and embedded credentials enable data theft and follow-on access to connected data stores.

How severe is it?

CVSS 3.1

4.3 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRLow

UINone

SUnchanged

CLow

INone

ANone

What should I do?

1 step

1) Upgrade Datalore to version 2026.4 or later per the JetBrains security advisory. 2) Until patched, restrict Datalore account creation to trusted users and limit access to the instance via network controls or SSO. 3) Audit access logs for requests where a user's session references workspace or notebook IDs they do not own, including sequential or enumerated ID patterns. 4) Rotate credentials, API keys and tokens stored in notebooks or run outputs on instances that had untrusted users. 5) Move secrets out of notebooks into a secrets manager and enforce workspace-level data classification.

How is it classified?

Data LeakageAuth BypassFrameworkAML.T0012- Valid Accounts AML.T0035- AI Artifact Collection AML.T0036- Data from Information Repositories

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.7.4-Quality of data for AI systems

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks and vulnerabilities

OWASP LLM Top 10

LLM02-Sensitive Information Disclosure

Frequently Asked Questions

What is CVE-2026-123291?

Is CVE-2026-123291 actively exploited?

No confirmed active exploitation of CVE-2026-123291 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-123291?

1) Upgrade Datalore to version 2026.4 or later per the JetBrains security advisory. 2) Until patched, restrict Datalore account creation to trusted users and limit access to the instance via network controls or SSO. 3) Audit access logs for requests where a user's session references workspace or notebook IDs they do not own, including sequential or enumerated ID patterns. 4) Rotate credentials, API keys and tokens stored in notebooks or run outputs on instances that had untrusted users. 5) Move secrets out of notebooks into a secrets manager and enforce workspace-level data classification.

What systems are affected by CVE-2026-123291?

This vulnerability affects the following AI/ML architecture patterns: Training pipelines, Shared data science notebook platforms, ML experimentation environments, Multi-tenant ML development workspaces.

What is the CVSS score for CVE-2026-123291?

CVE-2026-123291 has a CVSS v3.1 base score of 4.3 (MEDIUM).

What is the AI security impact?

Affected AI Architectures

Training pipelinesShared data science notebook platformsML experimentation environmentsMulti-tenant ML development workspaces

MITRE ATLAS Techniques

AML.T0012Valid Accounts

AML.T0035AI Artifact Collection

AML.T0036Data from Information Repositories

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.7.4

NIST AI RMF: MANAGE 2.3

OWASP LLM Top 10: LLM02

What are the technical details?

Original Advisory

In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook

Exploitation Scenario

An attacker obtains a low-privilege account on a shared Datalore instance, for example through a trial signup or a contractor account. They use their own session to request issue and run notebook endpoints, substituting workspace or object identifiers belonging to other tenants. Because owner validation is missing, the server returns the other workspace's data. The attacker harvests notebook outputs, dataset paths, embedded cloud or database credentials and experiment details, then uses the credentials for lateral movement into data stores or reuses the proprietary modeling work.

Weaknesses (CWE)

CWE-639Authorization Bypass Through User-Controlled KeyPrimary CWE-639Authorization Bypass Through User-Controlled Key

CWE-639 — Authorization Bypass Through User-Controlled Key: The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

[Architecture and Design] For each and every data access, ensure that the user has sufficient privilege to access the record that is being requested.
[Architecture and Design, Implementation] Make sure that the key that is used in the lookup of a specific user's record is not controllable externally by the user or that any tampering can be detected.

Source: MITRE CWE corpus.