CVE-2026-123280: JetBrains Datalore unauthenticated code execution via published reports

CVE-2026-123280 · Severity: high · CVSS 8.1 · Published 2026-11-06

JetBrains Datalore is a data science and analytics platform that publishes interactive reports for sharing analysis results. Unauthenticated attackers could execute arbitrary code by exploiting published interactive reports, gaining full control of the Datalore instance and access to sensitive data or computations.

Technologies: Jetbrains Datalore. Vendors: Jetbrains.

Quick answers

Is CVE-2026-123280 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-123280 being exploited in the wild.
How severe is CVE-2026-123280?
High severity, with a CVSS score of 8.1, published 6 November 2026.
Which products and versions are affected?
Jetbrains Datalore before 2026.2.4.
Is there a fix for CVE-2026-123280?
Yes: fixed in 2026.2.4. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123280 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-123280?
Check whether you run Jetbrains Datalore at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 2026.2.4

Technical details

The vulnerability allows unauthenticated remote code execution through published interactive reports in JetBrains Datalore before version 2026.2.4. An attacker can craft a malicious request targeting a published report to execute arbitrary code on the server, bypassing authentication requirements.

Affected products

  • JetBrains Datalore before 2026.2.4

Timeline

  • 2026-11-06: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.