Skip to content

Exploited: 178

LatestCVE-2026-123294 — In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow

9.0

CVE-2026-123279Fix available

In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators

JetBrains Datalore2026-11-06 10:27 UTC1 min readRead in

Summary

In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators

Remediation

Inventory every JetBrains Datalore deployment, including staging.
Upgrade JetBrains Datalore to 2026.4.
Confirm the running version after the upgrade.

References

Referencehttps://www.jetbrains.com/privacy-security/issues-fixed/

CVSS vector

Attack vector: Network
Complexity: Low
Privileges: Low
User interaction: Required
Scope: Changed
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Affected versions

Version	Fixed in
0 – <2026.4	2026.4

Weakness

CWE-863

Timeline

2026-11-06Publicly disclosed

Sources

CVE · NVD