External risk intelligence

JetBrains Datalore View-Only Collaborator Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-123279

JetBrains Datalore is a web-based data science and notebook platform. Such platforms are typically deployed as web applications intended for collaboration and remote access, making them commonly reachable from the internet or accessible via corporate network perimeters as part of standard service delivery.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability in JetBrains Datalore allows unauthorized code execution by view-only collaborators within a notebook's computation. This could potentially lead to unauthorized actions or data manipulation if the affected system is exposed. The main concern is confirming relevance and exposure.

Unauthorized users can run code.
It affects collaborative data science tools.
Confirm if Datalore is in use.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by tricking a user with view-only access into interacting with a malicious notebook. This interaction would allow the attacker to execute arbitrary code within the notebook's computation environment, potentially leading to a compromise of the Datalore instance.

View-only collaborator access required.
User interaction with a malicious notebook.
Code execution within the computation environment.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, view-only collaborators could execute code within a notebook's computation in JetBrains Datalore. This could affect the integrity and availability of the notebook's computation environment and potentially lead to the exposure of sensitive information processed by the notebook.

Notebook computations and environment.
Code execution by view-only collaborators.
Compromised computation integrity and data.

Operational Fix

Recommended remediation, mitigation, and detection steps

Understanding and addressing this vulnerability requires collaboration between application owners and platform or infrastructure teams responsible for hosting JetBrains Datalore. The initial practical step is to identify all Datalore instances, assess their reachability and business criticality, and then engage the accountable team to plan remediation, prioritizing based on risk.

Application owners should prioritize this issue.
Verify Datalore instance reachability and criticality.
Plan coordinated remediation or risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is JetBrains Datalore?

JetBrains Datalore is a web-based platform designed for data science and collaborative notebook programming. It allows teams to write, run, and share code and data visualizations in a browser, acting as an integrated environment for analysis rather than a traditional local code editor.

What does CVE-2026-123279 mean for notebook security?

This vulnerability involves an Improper Authorization weakness (CWE-863). Essentially, the software fails to properly enforce access restrictions, allowing a user who should only be able to view a notebook to instead execute code within its underlying computation environment.

How is this code execution triggered?

An attacker needs an account with view-only access to a notebook. They must then trick that user into interacting with a specifically prepared, malicious notebook. Simply having view access or being a collaborator does not inherently trigger the bug without this specific user interaction.

Is my Datalore instance at risk?

According to Halo Surface Signal, Datalore is typically deployed as a web application for collaboration and remote access, often making it reachable from the internet or via corporate networks. If your instance is accessible beyond a local, isolated environment, it is more likely to be exposed to this risk.

Do I need to update my Datalore software?

Start by identifying all Datalore instances in your environment and confirming their specific version. Once you have an inventory, work with the team responsible for hosting these services to verify the installation path and coordinate the transition to a patched version.

References

www.jetbrains.com/privacy-security/issues-fixed/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.