Description

In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-11-06T11:17:06.270Z",
  "pubdate": "2026-11-06T11:17:06.270Z",
  "executiveSummary": "A critical security vulnerability has been identified in JetBrains Datalore versions prior to 2026.2.4, involving the improper handling of interactive report execution.\nThis vulnerability is classified as an unauthenticated Remote Code Execution (RCE) flaw, allowing external, non-authenticated actors to execute arbitrary code on the underlying server infrastructure.\nThe vulnerability resides within the published report functionality, which fails to adequately sanitize or restrict user-supplied inputs or execution contexts.\nThe risk implication is severe, as successful exploitation results in full system compromise, potential data exfiltration, and lateral movement within the hosting environment.\nExploitation does not require prior authentication, making the attack surface publicly accessible if the Datalore instance is exposed to the internet.\nOrganizations utilizing Datalore must prioritize immediate patching to the version 2026.2.4 or later to remediate this critical security gap.",
  "technicalDetails": "The vulnerability originates from a failure in the Datalore interactive report publication subsystem to enforce authentication and authorization controls for report execution requests.\nIn affected versions, the application processes requests related to published interactive reports without validating the identity of the requester, effectively bypassing authentication layers intended to secure the reporting environment.\nThe root cause lies in an insufficient sandbox or execution policy for interactive reports when accessed in a public state. The application fails to properly isolate or restrict the environment in which these reports execute, allowing input parameters to influence server-side operations directly.\nAn attacker can exploit this by crafting specific HTTP requests directed at the published report endpoint. By manipulating the parameters passed to the report execution engine, an attacker can inject and execute arbitrary code within the context of the Datalore service process.\nThe attack flow proceeds as follows: 1) The attacker identifies a publicly accessible interactive report URL hosted on a vulnerable Datalore instance. 2) The attacker interacts with the report parameters to inject malicious code or commands. 3) The backend server, failing to perform input validation or enforce restricted execution scopes for unauthenticated users, processes these parameters through its execution engine. 4) The malicious payload is executed with the privileges of the Datalore server application.\nThis vulnerability exposes the internal server architecture to unauthorized command execution. Once code execution is achieved, the attacker can leverage the server's context to perform post-exploitation activities, including accessing sensitive data stored in connected databases, modifying system files, or establishing a persistent presence on the host server.\nThe lack of authentication requirements significantly increases the risk, as the exploitation vector is network-accessible without credential verification. The impact extends beyond the application layer, potentially allowing the attacker to gain full control over the host operating system if the Datalore process is running with elevated permissions.\nThe vulnerability is limited to the published reports functionality within the JetBrains Datalore product prior to version 2026.2.4."
}