First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-123281

HighCVSS 7.5/10Last modified Nov 10, 2026

Description

In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

Vendor	Product	Versions
JetBrains	Datalore	< 2026.4

References

https://www.jetbrains.com/privacy-security/issues-fixed/

Timeline

Published: Nov 6, 2026
Last modified: Nov 10, 2026
NVD status: Undergoing Analysis

Related CVEs from 2026

CVE-2026-1232827.4In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session CVE-2026-1232836.8In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account CVE-2026-1232846.5In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content CVE-2026-1232858.8In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection CVE-2026-1232866.5In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token CVE-2026-1232877.5In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports CVE-2026-1232885.4In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link CVE-2026-1232894.3In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files CVE-2026-123295.3Memory safety bug fixed in Thunderbird ESR 140.12. This vulnerability was fixed in Firefox ESR 140.12 and Thunderbird 140.12.CVE-2026-1232905.3In JetBrains Datalore before 2026.4 hidden notebook code was exposed to unauthenticated users via the public interactive report content endp CVE-2026-1232914.3In JetBrains Datalore before 2026.4 improper owner validation allowed reading another workspace's issues and runs notebook CVE-2026-1232922.7In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid

CVE-2026-123281: High severity, CVSS 7.5 | Vulnix