JetBrains Datalore multiple access-check flaws allow code execution
Collaborators or viewers can steal or change notebook contents!
Summary
The JetBrains Datalore notebook platform has many flaws letting collaborators and viewers run code, read or change files, or take over accounts without permission. Versions before 2026.4 are affected.
What to do
Check that the running Datalore is version 2026.4 or newer; if it is older, update and read the JetBrains advisory.
Products and platforms
CVE IDs
- CVE-2026-123279 (opens in a new tab)
- CVE-2026-123281 (opens in a new tab)
- CVE-2026-123282 (opens in a new tab)
- CVE-2026-123283 (opens in a new tab)
- CVE-2026-123284 (opens in a new tab)
- CVE-2026-123286 (opens in a new tab)
- CVE-2026-123287 (opens in a new tab)
- CVE-2026-123288 (opens in a new tab)
- CVE-2026-123289 (opens in a new tab)
- CVE-2026-123290 (opens in a new tab)
- CVE-2026-123291 (opens in a new tab)
- CVE-2026-123292 (opens in a new tab)
- CVE-2026-123834 (opens in a new tab)
- CVE-2026-123835 (opens in a new tab)
- CVE-2026-123836 (opens in a new tab)
Sources
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
Times
First published
First seen