{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-32745", "assignerOrgId": "547ada31-17d8-4964-bc5f-1b8238ba8014", "state": "PUBLISHED", "assignerShortName": "JetBrains", "dateReserved": "2026-03-13T15:48:07.191Z", "datePublished": "2026-03-13T15:50:04.434Z", "dateUpdated": "2026-03-17T12:54:07.103Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "547ada31-17d8-4964-bc5f-1b8238ba8014", "shortName": "JetBrains", "dateUpdated": "2026-03-13T15:50:04.434Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-614", "cweId": "CWE-614"}]}], "affected": [{"vendor": "JetBrains", "product": "Datalore", "versions": [{"version": "0", "status": "affected", "lessThan": "2026.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings"}], "references": [{"url": "https://www.jetbrains.com/privacy-security/issues-fixed/"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "ADJACENT_NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N"}}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-03-16T17:07:13.269913Z", "id": "CVE-2026-32745", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-17T12:54:07.103Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-32745", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-16T17:07:13.269913Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-03-16T17:07:17.829Z"}}], "cna": {"metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "JetBrains", "product": "Datalore", "versions": [{"status": "affected", "version": "0", "lessThan": "2026.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://www.jetbrains.com/privacy-security/issues-fixed/"}], "descriptions": [{"lang": "en", "value": "In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-614", "description": "CWE-614"}]}], "providerMetadata": {"orgId": "547ada31-17d8-4964-bc5f-1b8238ba8014", "shortName": "JetBrains", "dateUpdated": "2026-03-13T15:50:04.434Z"}}}, "cveMetadata": {"cveId": "CVE-2026-32745", "state": "PUBLISHED", "dateUpdated": "2026-03-17T12:54:07.103Z", "dateReserved": "2026-03-13T15:48:07.191Z", "assignerOrgId": "547ada31-17d8-4964-bc5f-1b8238ba8014", "datePublished": "2026-03-13T15:50:04.434Z", "assignerShortName": "JetBrains"}, "dataVersion": "5.2"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jetbrains:datalore:*:*:*:*:*:*:*:*", "matchCriteriaId": "54F3034A-2ADD-4FE7-8CAD-A70B4FC2F6FF", "versionEndExcluding": "2026.1", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In JetBrains Datalore before 2026.1 session hijacking was possible due to missing secure attribute for cookie settings"}, {"lang": "es", "value": "En JetBrains Datalore antes de 2026.1 el secuestro de sesi\u00f3n era posible debido a la falta del atributo seguro para la configuraci\u00f3n de cookies."}], "id": "CVE-2026-32745", "lastModified": "2026-04-02T14:55:21.807", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 6.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 4.2, "source": "cve@jetbrains.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "NONE", "baseScore": 5.7, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 2.1, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2026-03-13T19:55:09.983", "references": [{"source": "cve@jetbrains.com", "tags": ["Vendor Advisory"], "url": "https://www.jetbrains.com/privacy-security/issues-fixed/"}], "sourceIdentifier": "cve@jetbrains.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-614"}], "source": "cve@jetbrains.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-319"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,2026.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "product": "datalore", "vendor": "jetbrains"}], "analysis": {"en": {"generated_at": "2026-04-02T17:00:53.166571+00:00", "value": {"mitigation_remediation": ["Apply a Datalore upgrade to version 2026.1 or later, which sets the Secure flag on session cookies.", "If upgrading is not possible immediately, manually configure the web server to set the Secure attribute on the session cookie for Datalore.", "Ensure that all user traffic to Datalore is served over HTTPS to prevent cookie interception.", "Monitor access logs for anomalous session activity and consider implementing additional session timeout or integrity checks."], "summary": {"action": "Patch Upgrade", "impact": "Session Hijacking"}, "threat_synthesis": {"affected_systems": "JetBrains Datalore products before release 2026.1 are affected. All installations that use the default unsecured cookie setting are at risk; no specific sub\u2011version details are provided beyond the pre\u20112026.1 timeframe.", "description_and_impact": "The vulnerability allows an attacker to hijack user sessions by exploiting an insecure cookie configuration. Because the cookie set by JetBrains Datalore lacks the Secure flag, it can be transmitted over non\u2011HTTPS connections and may be captured or forged. An attacker who obtains a valid session cookie can impersonate a user and gain unauthorized access to the Datalore workspace, exposing sensitive data and potentially enabling further attacks. The weakness is represented by CWE\u2011319 and CWE\u2011614.", "risk_and_exploitability": "The CVSS score of 6.3 indicates moderate severity. The EPSS score is less than 1%, suggesting a low likelihood of exploitation in the short term, though the impact remains serious if the flaw is used. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires only the ability to read or modify cookie values, which can be achieved by intercepting traffic over HTTP or via cross\u2011site scripting. Thus the primary attack vector is inferred to be remote over unsecured connections, potentially in environments where the Datalore server is reachable via HTTP."}}}}, "created": "2026-03-16T09:25:05.599259+00:00", "updated": "2026-04-02T20:23:51.162995+00:00", "vendors": ["jetbrains", "jetbrains$PRODUCT$datalore"]}