medium · CVSS v3 5.3

CVE-2026-123290

JetBrains Datalore versions prior to 2026.4 expose hidden notebook code through a public interactive report content endpoint, allowing unaut

Overview

JetBrains Datalore versions prior to 2026.4 expose hidden notebook code through a public interactive report content endpoint, allowing unauthenticated users to view sensitive code. This flaw can leak proprietary logic and data. The issue affects all deployments using the affected Datalore releases.

Description

In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endpoint

Impact

Confidentiality is compromised as hidden notebook code becomes publicly accessible. Integrity of the notebook environment is at risk if attackers modify or inject code. Availability is not directly affected, but the exposure can lead to further attacks. Defenders should treat exposed code as sensitive data leakage.

Remediation

Upgrade to JetBrains Datalore 2026.4 or later where the endpoint is secured. If upgrade is not immediately possible, restrict access to the interactive report content endpoint via firewall rules or internal network segmentation. Enable authentication checks and monitor for unauthorized access attempts.

Risk context

The CVSS v3 score of 5.3 indicates medium severity. No EPSS data is available, so the urgency is based on the potential for data leakage. Defenders should act promptly to patch or mitigate.

Affected products

  • JetBrains Datalore 2026.3
  • JetBrains Datalore 2026.2
  • JetBrains Datalore 2026.1
  • JetBrains Datalore 2025.4
  • JetBrains Datalore 2025.3
  • JetBrains Datalore 2025.2
  • JetBrains Datalore 2025.1
  • JetBrains Datalore 2024.4

Scores

Severity
medium
CVSS v2
5
CVSS v3
5.3
CVSS v4
—
EPSS
—

JetBrains Datalore Notebook CodeExposure MediumSeverity AuthenticationBreach DataLeak

← All CVEs

Related CVEs

medium

CVE-2026-120659

The Redirection for Contact Form 7 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to write arbitrary post meta values to newly created lead posts and copy arbitrary server-side files with allowed MIME-type extensions into the plugin's uploads directory. Exploitation requires a published Contact Form 7 form configured with the Save Entry (Save Lead) action enabled on the target site.

View analysis

medium

CVE-2026-123287

In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports

View analysis

medium

CVE-2026-84164

The HTML report that plist-to-html, CodeChecker parse --export html and CodeChecker cmd diff --output html generate puts the report message, the checker name and the source file path into a script block through json.dumps. json.dumps does not escape the less-than character, so a closing script tag in any of those three fields ends the script element and what follows is parsed as HTML. The input author is whoever controls the analysed tree or a third-party result file that report-converter ingests, or who holds PRODUCT_STORE in the cmd diff flow. The viewer is somebody else: docs/jenkins_gerrit_integration.md documents writing the report into Jenkins userContent and posting its URL into a Gerrit review. One caveat worth stating up front is that Jenkins serves userContent under a restrictive CSP that would block an inline handler, so that destination is probably safe as configured. The generated report sets no CSP of its own, so the impact lands wherever it is published without one.

View analysis

medium

CVE-2026-121633

The Order Tracking WordPress plugin before 3.6.0 does not verify that a PayPal payment notification was sent to the merchant's account, or that its amount matches the order total, before marking an order as paid, which could allow unauthenticated attackers to mark arbitrary orders as paid using a trivial payment to their own PayPal account.

View analysis