CVE-2026-123836

Summary

In JetBrains Datalore before version 2026.4, authenticated workspace collaborators with write access could exploit a misconfigured Git backup mechanism to retrieve the workspace owner's SSH private key, violating confidentiality and enabling potential lateral movement or infrastructure compromise.

Exploitability

Exploitation requires valid low-privilege user credentials (collaborator role) and knowledge of the internal Git backup process; no external authentication bypass is involved.

Blast radius

Successful exploitation allows an attacker to impersonate the workspace owner in Git operations, potentially compromising connected infrastructure, repositories, or cloud resources protected by that key.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to JetBrains Datalore 2026.4 or later, which patches the insecure Git backup handling that exposed SSH private keys to collaborators.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.