External risk intelligence

JetBrains Datalore Unauthenticated Code Execution via Published Reports

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-123280

JetBrains Datalore includes functionality for publishing interactive reports. These published reports are designed to be accessible over the public internet by design, making the vulnerability reachable by unauthenticated users in normal product use cases.

Jetbrains Datalore

before 2026.2.4

Halo Surface Signal: 5 out of 5 — more likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in JetBrains Datalore, allowing unauthenticated users to execute code through published interactive reports. This issue could potentially lead to unauthorized access and manipulation of systems running the affected software.

Unauthenticated users can run code on published reports.
It affects widely accessible interactive reports.
Confirm relevance and exposure to Datalore reports.

Attack Path

How an attacker could exploit the issue

An attacker could compromise a system running JetBrains Datalore by leveraging its feature that allows users to publish interactive reports. Since these reports are accessible and can be executed by unauthenticated users, an attacker could potentially reach the vulnerable component through publicly available reports, leading to the execution of arbitrary code.

Unauthenticated access to published reports.
Triggered by viewing an interactive report.
Remote code execution with high impact.

Live Threat

Current exploitation, exposure, and threat context

Unauthenticated users could execute arbitrary code through published interactive reports in JetBrains Datalore when those reports are exposed. This could allow an attacker to compromise the affected system by running commands, potentially impacting the confidentiality, integrity, and availability of the system and its data.

System data and service behavior.
Via published interactive reports.
Arbitrary code execution and system compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

For this vulnerability in JetBrains Datalore, application owners are likely responsible for managing the product. The first practical move is to identify all instances of Datalore, assess their reachability and criticality, and then confirm the accountable owner. Following this, a risk-based remediation plan should be developed.

Application owners should manage this issue.
Verify Datalore instance reachability and criticality.
Plan remediation based on identified risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is JetBrains Datalore?

JetBrains Datalore is a collaborative data science platform designed for Jupyter notebook editing, data analysis, and visualization. It includes features that allow users to share their work publicly or within teams by publishing interactive reports. These reports enable viewers to interact with data and code outputs in a browser, making it a common tool for data scientists to present findings to broader audiences.

What does CWE-863 mean for CVE-2026-123280?

CWE-863 refers to Incorrect Authorization. In the context of this vulnerability, it means the software fails to properly check if a user is allowed to perform a specific action. For CVE-2026-123280, the application does not enforce access controls, which incorrectly permits unauthenticated users to trigger code execution through published interactive reports that should otherwise be restricted or safe.

How is this vulnerability triggered?

The vulnerability is triggered when an unauthenticated user accesses or interacts with a published Datalore report. It is the act of interacting with these reports that allows the code execution to occur. Importantly, this does not require a user to log in or possess any specific credentials; simply accessing the published report is sufficient. If no reports have been published on an instance, that specific vector remains inactive.

Is my JetBrains Datalore instance at risk?

If your instance hosts published interactive reports, it is highly likely to be affected. According to Halo Surface Signal, these reports are designed to be accessible over the public internet, meaning the vulnerable component is often reachable by anyone online. You should check if your organization uses the publishing feature, as instances configured for public or wide access face the highest risk of unauthorized exploitation.

What should I do first to address CVE-2026-123280?

Your first step is to locate all instances of Datalore within your environment to understand your footprint. Once identified, evaluate which servers host published reports and determine if those reports are accessible to unauthorized users. Coordinate with the relevant application owners to assess the risk and prioritize the implementation of the official security update provided by JetBrains to resolve the issue.

References

www.jetbrains.com/privacy-security/issues-fixed/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.