The vulnerability in JetBrains Datalore before version 2026.4 allows workspace collaborators to obtain the owner's SSH private key through the Git backup feature. This exposure can lead to the theft of privileged credentials, enabling attackers to authenticate as the workspace owner to external services and potentially conduct unauthorized actions or exfiltrate data. The weakness is tied to CWE‑59, which represents improper restriction of operations within the bounds of a memory buffer. The impact is primarily focused on confidentiality and the potential for remoteized access to systems the key controls.

Affected systems include all installations of JetBrains Datalore older than version 2026.4 where workspace collaborators have the Git backup feature enabled. No specific subcomponents or configuration settings are listed beyond the Git backup capability. Any JetBrains Datalore instance that has not yet been patched to 2026.4 or later is potentially vulnerable.

The CVSS score of 8.8 indicates high severity. The exploit probability (EPSS) has not been published, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it has not yet been widely exploited. The likely attack vector requires an authenticated collaborator with access to initiate a Git backup, and the attacker must be able to read the backup output to extract the private key. Compromise of the private key can provide attackers with unrestricted access to any systems that the key serves.