CVE-2026-123279

Summary

In JetBrains Datalore before version 2026.4, view-only collaborators could execute arbitrary code within notebook computations due to insufficient authorization checks (CWE-863), allowing full compromise of confidentiality, integrity, and availability.

Exploitability

Exploitation requires low skill and only a valid authenticated account with view-only permissions in a shared notebook; user interaction (e.g., opening the notebook) is required.

Blast radius

Successful exploitation grants attackers full control over the computation environment, potentially affecting all data and resources accessible to the Datalore service, including sensitive notebooks and backend systems.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to JetBrains Datalore 2026.4 or later, which patches the authorization flaw allowing view-only users to trigger code execution.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.