Datalore
Monthly
Unauthenticated path traversal in the report blob endpoint of JetBrains Datalore before version 2026.2.1 allows a remote attacker who can reach the service to read arbitrary files accessible to the Datalore process. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5 HIGH), exploitation requires no credentials and no user interaction, making exposure the primary limiting factor: only network-reachable instances below 2026.2.1 are at risk, and the flaw yields confidentiality loss only, with no integrity or availability impact and no code execution on its own. There is no CISA KEV listing and no public exploit code identified at time of analysis, though the low-complexity, unauthenticated nature of the bug makes it an attractive target for opportunistic scanning of internet-facing deployments.
JetBrains Datalore versions before 2026.1 contain a session hijacking vulnerability (CVE-2026-32745) caused by missing secure attribute configuration on session cookies, allowing attackers on the same network to intercept and reuse session tokens. The vulnerability affects all Datalore versions prior to 2026.1 and requires adjacent network access combined with user interaction; while the CVSS score is moderate (6.3), the impact is high for confidentiality and enables unauthorized account access.
Unauthenticated path traversal in the report blob endpoint of JetBrains Datalore before version 2026.2.1 allows a remote attacker who can reach the service to read arbitrary files accessible to the Datalore process. Per the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, base 7.5 HIGH), exploitation requires no credentials and no user interaction, making exposure the primary limiting factor: only network-reachable instances below 2026.2.1 are at risk, and the flaw yields confidentiality loss only, with no integrity or availability impact and no code execution on its own. There is no CISA KEV listing and no public exploit code identified at time of analysis, though the low-complexity, unauthenticated nature of the bug makes it an attractive target for opportunistic scanning of internet-facing deployments.
JetBrains Datalore versions before 2026.1 contain a session hijacking vulnerability (CVE-2026-32745) caused by missing secure attribute configuration on session cookies, allowing attackers on the same network to intercept and reuse session tokens. The vulnerability affects all Datalore versions prior to 2026.1 and requires adjacent network access combined with user interaction; while the CVSS score is moderate (6.3), the impact is high for confidentiality and enables unauthorized account access.