What is the CVSS score of CVE-2026-32745?

CVE-2026-32745 has a CVSS 3.1 base score of 6.3 (Medium). CVSS vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Datalore are affected by CVE-2026-32745?

Organizations using JetBrains Datalore should be aware of moderate risk from CVE-2026-32745 rated CVSS 6.3. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2026-32745?

Within 30 days: Identify affected systems running JetBrains Datalore and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Datalore CVE-2026-32745

EUVD-2026-12045 MEDIUM

Sensitive Cookie in HTTPS Session Without 'Secure' Attribute (CWE-614)

2026-03-13 JetBrains

Information Disclosure Datalore JetBrains

6.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.3 MEDIUM

AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Adjacent

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

None

Lifecycle Timeline

Patch available

Apr 16, 2026 - 05:29 EUVD

2026.1

EUVD ID Assigned

Mar 13, 2026 - 16:57 euvd

EUVD-2026-12045

Analysis Generated

Mar 13, 2026 - 16:57 vuln.today

CVE Published

Mar 13, 2026 - 15:50 nvd

MEDIUM 6.3

DescriptionCVE.org

In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings

AnalysisAI

JetBrains Datalore versions before 2026.1 contain a session hijacking vulnerability (CVE-2026-32745) caused by missing secure attribute configuration on session cookies, allowing attackers on the same network to intercept and reuse session tokens. The vulnerability affects all Datalore versions prior to 2026.1 and requires adjacent network access combined with user interaction; while the CVSS score is moderate (6.3), the impact is high for confidentiality and enables unauthorized account access.

Technical ContextAI

This vulnerability (CWE-614: Insecure Cookie Transmission) involves improper HTTP cookie security configuration in JetBrains Datalore's session management implementation. The missing 'Secure' flag on session cookies allows them to be transmitted over unencrypted HTTP connections or intercepted by network-level attacks (ARP spoofing, MITM on local networks). The affected product is identified via CPE: cpe:2.3:a:jetbrains:datalore:*:*:*:*:*:*:*:* (all versions). The root cause is insufficient hardening of cookie attributes; proper remediation requires setting the Secure flag to enforce HTTPS-only transmission, supplemented by HttpOnly and SameSite flags to prevent XSS-based theft and CSRF attacks respectively.

RemediationAI

Upgrade JetBrains Datalore to version 2026.1 or later (https://www.jetbrains.com/privacy-security/issues-fixed/) Mitigation (Pre-Patch): Enforce HTTPS-only connections to Datalore instances via reverse proxy (nginx/Apache with HSTS header 'Strict-Transport-Security: max-age=31536000; includeSubDomains') Mitigation (Pre-Patch): Restrict network access to Datalore instances using firewall rules to trusted networks only, reducing attack surface to adjacent network threat actors Mitigation (Pre-Patch): Implement VPN or network segmentation to isolate Datalore deployment from untrusted network segments Detection: Monitor HTTP access logs for unencrypted session cookie transmission; implement network IDS rules to detect cookie interception patterns on local network segments