{"id":"CVE-2026-123836","published":"2026-11-06T17:17:21.963","lastModified":"2026-11-06T21:17:07.777","description":"In JetBrains Datalore before 2026.4 workspace collaborators could obtain the owner's SSH private key via Git backup","cvssScore":8.8,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-59"],"vendors":[],"products":[],"references":[{"url":"https://www.jetbrains.com/privacy-security/issues-fixed/","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"In JetBrains Datalore before version 2026.4, authenticated workspace collaborators with write access could exploit a misconfigured Git backup mechanism to retrieve the workspace owner's SSH private key, violating confidentiality and enabling potential lateral movement or infrastructure compromise.","exploitability":"Exploitation requires valid low-privilege user credentials (collaborator role) and knowledge of the internal Git backup process; no external authentication bypass is involved.","blast_radius":"Successful exploitation allows an attacker to impersonate the workspace owner in Git operations, potentially compromising connected infrastructure, repositories, or cloud resources protected by that key.","remediation":"Upgrade to JetBrains Datalore 2026.4 or later, which patches the insecure Git backup handling that exposed SSH private keys to collaborators.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["ssh-key-exposure","git-backup","privilege-escalation","data-exfiltration"],"model":"garnet-coder","analyzedAt":"2026-11-08T09:51:10.312Z"}}