Datalore EUVD-2026-12045

The CVSS:3.1 vector (AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) indicates moderate overall severity but notable practical constraints: attack vector is Adjacent (local network only), which significantly limits widespread exploitation compared to network-accessible vulnerabilities. Attack complexity is Low and no privileges are required, but User Interaction is required (victim must visit attacker-controlled content or be on compromised network). Confidentiality impact is High (full session compromise), Integrity is Low (limited to session scope), and Availability is None. The real-world risk is contextual: in air-gapped environments or cloud-hosted Datalore instances, this is lower priority; in shared corporate networks or public WiFi scenarios, it becomes substantially more critical. No publicly disclosed POC or KEV status is indicated in provided intelligence, suggesting this may be a responsibly-disclosed researcher finding rather than actively exploited in the wild. SSVC assessment: exploitation is Likely (session interception is straightforward with network access), automatable (can be scripted), and technical impact is total (full account compromise), but this is only feasible for authenticated users on the attacker's network segment.

An attacker positioned on the same local network (corporate WiFi, shared office network, or compromised router) performs passive network sniffing using tools like tcpdump or Wireshark. When a legitimate Datalore user initiates an HTTP (non-HTTPS) connection or when the application transmits session cookies without the Secure flag, the attacker captures the session cookie in cleartext. The attacker then replays this cookie in their own HTTP requests to the Datalore instance, gaining full authenticated access to the victim's account without knowing their password. If Datalore is hosted behind HTTPS, the attack requires the user to click a phishing link to an HTTP variant of the site (AV:A/UI:R satisfied). The attacker gains high confidentiality impact by accessing sensitive data/notebooks and limited integrity impact by modifying session state. No POC is noted in current intelligence, but cookie interception is a well-understood technique and readily automatable.