Search
Find a vulnerability
Search criteria
2 vulnerabilities found for RStudio Server by Posit Software, PBC
CVE-2026-121880 (GCVE-0-2026-121880)
Vulnerability from nvd – Published: 2026-11-06 15:10 – Updated: 2026-11-06 17:45
VLAI
EPSS
VEX
Title
RStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership
Summary
Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session.
NOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 17:21 UTC
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://docs.posit.co/ide/news/#rstudio-2026.08.0 | release-notesvendor-advisory |
| https://trust.posit.co/updates | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Posit Software, PBC | Posit Workbench |
Affected:
0 , < 2026.08.0
(custom)
cpe:2.3:a:posit:workbench:*:*:*:*:*:*:*:* |
|
| Posit Software, PBC | RStudio Server |
Affected:
0 , < 2026.08.0
(custom)
cpe:2.3:a:posit:rstudio_server:*:*:*:*:*:*:*:* |
Date Public
2026-11-04 11:03
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121880",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T17:21:05.517519Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T17:45:27.737Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://posit.co/download/rstudio-server-pro/",
"cpes": [
"cpe:2.3:a:posit:workbench:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"localhost port-proxy (/p/\u003ctoken\u003e/)"
],
"platforms": [
"Linux"
],
"product": "Posit Workbench",
"programFiles": [
"src/cpp/core/http/UrlPorts.cpp"
],
"vendor": "Posit Software, PBC",
"versions": [
{
"lessThan": "2026.08.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"collectionURL": "https://posit.co/download/rstudio-server/",
"cpes": [
"cpe:2.3:a:posit:rstudio_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"localhost port-proxy (/p/\u003ctoken\u003e/)"
],
"platforms": [
"Linux"
],
"product": "RStudio Server",
"programFiles": [
"src/cpp/core/http/UrlPorts.cpp"
],
"vendor": "Posit Software, PBC",
"versions": [
{
"lessThan": "2026.08.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAffects multi-user RStudio Server / Posit Workbench deployments in which more than one user has an interactive session on the same host and application proxying via the localhost port-proxy is enabled (the default).\u0026nbsp;\u003c/p\u003e"
}
],
"value": "Affects multi-user RStudio Server / Posit Workbench deployments in which more than one user has an interactive session on the same host and application proxying via the localhost port-proxy is enabled (the default)."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Luiz Felipe Mol (confu53)"
}
],
"datePublic": "2026-11-04T11:03:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization bypass through user-controlled key in the localhost port-proxy (\u003ccode\u003e/p/\u0026lt;token\u0026gt;/\u003c/code\u003e) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user\u0027s session, and to view their live rendered content and data, via a proxy URL constructed from the attacker\u0027s own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user\u0027s session.\u003c/p\u003e\u003cp\u003eNOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by \u003ccode\u003eallow-shell=false\u003c/code\u003e; no setting restricts the port-proxy without disabling all application proxying.\u003c/p\u003e"
}
],
"value": "Authorization bypass through user-controlled key in the localhost port-proxy (/p/\u003ctoken\u003e/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user\u0027s session, and to view their live rendered content and data, via a proxy URL constructed from the attacker\u0027s own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user\u0027s session.\n\n\n\nNOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Information disclosure: an authenticated user can view another user\u0027s running application and the data it renders. Where other network services are bound to localhost on the same host, those services may also become reachable through the proxy, and the potential impact in those deployments depends on what is running and how it is configured."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "AUTOMATIC",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y/R:A/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:12:38.657Z",
"orgId": "8c484e69-127d-402b-9cdb-5f86ef43eb86",
"shortName": "POSIT"
},
"references": [
{
"name": "RStudio IDE / RStudio Server release notes",
"tags": [
"release-notes",
"vendor-advisory"
],
"url": "https://docs.posit.co/ide/news/#rstudio-2026.08.0"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://trust.posit.co/updates"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Posit Workbench 2026.08.0 or later, or RStudio Server 2026.08.0 or later. The patched releases verify that a port requested through the localhost port-proxy belongs to the requesting user\u0027s session.\u003c/p\u003e"
}
],
"value": "Upgrade to Posit Workbench 2026.08.0 or later, or RStudio Server 2026.08.0 or later. The patched releases verify that a port requested through the localhost port-proxy belongs to the requesting user\u0027s session."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-05-22T00:00:00.000Z",
"value": "Reported to Posit through coordinated disclosure"
},
{
"lang": "en",
"time": "2026-05-22T00:00:00.000Z",
"value": "Reproduced internally with a working proof of concept against Posit Workbench 2025.09"
},
{
"lang": "en",
"time": "2026-07-22T00:00:00.000Z",
"value": "CVE submission and security advisory approved by Posit"
}
],
"title": "RStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUntil the patched release is applied, operators of multi-user instances can reduce exposure by separating sensitive workloads onto dedicated hosts or per-user isolated environments rather than sharing a single multi-user node; avoiding co-location of sensitive network services on hosts that also run user sessions; and limiting shared-server access to mutually trusted user populations where separation is not yet feasible. There is no setting that restricts the port-proxy without also disabling application proxying.\u003c/p\u003e"
}
],
"value": "Until the patched release is applied, operators of multi-user instances can reduce exposure by separating sensitive workloads onto dedicated hosts or per-user isolated environments rather than sharing a single multi-user node; avoiding co-location of sensitive network services on hosts that also run user sessions; and limiting shared-server access to mutually trusted user populations where separation is not yet feasible. There is no setting that restricts the port-proxy without also disabling application proxying."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "8c484e69-127d-402b-9cdb-5f86ef43eb86",
"assignerShortName": "POSIT",
"cveId": "CVE-2026-121880",
"datePublished": "2026-11-06T15:10:37.306Z",
"dateReserved": "2026-11-04T10:49:21.246Z",
"dateUpdated": "2026-11-06T17:45:27.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-121880 (GCVE-0-2026-121880)
Vulnerability from cvelistv5 – Published: 2026-11-06 15:10 – Updated: 2026-11-06 17:45
VLAI
EPSS
VEX
Title
RStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership
Summary
Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session.
NOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying.
Severity
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-11-06 17:21 UTC
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://docs.posit.co/ide/news/#rstudio-2026.08.0 | release-notesvendor-advisory |
| https://trust.posit.co/updates | vendor-advisory |
Impacted products
2 products
| Vendor | Product | Version | |
|---|---|---|---|
| Posit Software, PBC | Posit Workbench |
Affected:
0 , < 2026.08.0
(custom)
cpe:2.3:a:posit:workbench:*:*:*:*:*:*:*:* |
|
| Posit Software, PBC | RStudio Server |
Affected:
0 , < 2026.08.0
(custom)
cpe:2.3:a:posit:rstudio_server:*:*:*:*:*:*:*:* |
Date Public
2026-11-04 11:03
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-121880",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-11-06T17:21:05.517519Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T17:45:27.737Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://posit.co/download/rstudio-server-pro/",
"cpes": [
"cpe:2.3:a:posit:workbench:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"localhost port-proxy (/p/\u003ctoken\u003e/)"
],
"platforms": [
"Linux"
],
"product": "Posit Workbench",
"programFiles": [
"src/cpp/core/http/UrlPorts.cpp"
],
"vendor": "Posit Software, PBC",
"versions": [
{
"lessThan": "2026.08.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
},
{
"collectionURL": "https://posit.co/download/rstudio-server/",
"cpes": [
"cpe:2.3:a:posit:rstudio_server:*:*:*:*:*:*:*:*"
],
"defaultStatus": "unaffected",
"modules": [
"localhost port-proxy (/p/\u003ctoken\u003e/)"
],
"platforms": [
"Linux"
],
"product": "RStudio Server",
"programFiles": [
"src/cpp/core/http/UrlPorts.cpp"
],
"vendor": "Posit Software, PBC",
"versions": [
{
"lessThan": "2026.08.0",
"status": "affected",
"version": "0",
"versionType": "custom"
}
]
}
],
"configurations": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAffects multi-user RStudio Server / Posit Workbench deployments in which more than one user has an interactive session on the same host and application proxying via the localhost port-proxy is enabled (the default).\u0026nbsp;\u003c/p\u003e"
}
],
"value": "Affects multi-user RStudio Server / Posit Workbench deployments in which more than one user has an interactive session on the same host and application proxying via the localhost port-proxy is enabled (the default)."
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Luiz Felipe Mol (confu53)"
}
],
"datePublic": "2026-11-04T11:03:00.000Z",
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eAuthorization bypass through user-controlled key in the localhost port-proxy (\u003ccode\u003e/p/\u0026lt;token\u0026gt;/\u003c/code\u003e) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user\u0027s session, and to view their live rendered content and data, via a proxy URL constructed from the attacker\u0027s own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user\u0027s session.\u003c/p\u003e\u003cp\u003eNOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by \u003ccode\u003eallow-shell=false\u003c/code\u003e; no setting restricts the port-proxy without disabling all application proxying.\u003c/p\u003e"
}
],
"value": "Authorization bypass through user-controlled key in the localhost port-proxy (/p/\u003ctoken\u003e/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user\u0027s session, and to view their live rendered content and data, via a proxy URL constructed from the attacker\u0027s own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user\u0027s session.\n\n\n\nNOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying."
}
],
"impacts": [
{
"descriptions": [
{
"lang": "en",
"value": "Information disclosure: an authenticated user can view another user\u0027s running application and the data it renders. Where other network services are bound to localhost on the same host, those services may also become reachable through the proxy, and the potential impact in those deployments depends on what is running and how it is configured."
}
]
}
],
"metrics": [
{
"cvssV4_0": {
"Automatable": "YES",
"Recovery": "AUTOMATIC",
"Safety": "NOT_DEFINED",
"attackComplexity": "LOW",
"attackRequirements": "PRESENT",
"attackVector": "LOCAL",
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"exploitMaturity": "PROOF_OF_CONCEPT",
"privilegesRequired": "LOW",
"providerUrgency": "AMBER",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"valueDensity": "DIFFUSE",
"vectorString": "CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y/R:A/V:D/RE:M/U:Amber",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "NONE",
"vulnerabilityResponseEffort": "MODERATE"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-639",
"description": "CWE-639 Authorization Bypass Through User-Controlled Key",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-06T15:12:38.657Z",
"orgId": "8c484e69-127d-402b-9cdb-5f86ef43eb86",
"shortName": "POSIT"
},
"references": [
{
"name": "RStudio IDE / RStudio Server release notes",
"tags": [
"release-notes",
"vendor-advisory"
],
"url": "https://docs.posit.co/ide/news/#rstudio-2026.08.0"
},
{
"tags": [
"vendor-advisory"
],
"url": "https://trust.posit.co/updates"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUpgrade to Posit Workbench 2026.08.0 or later, or RStudio Server 2026.08.0 or later. The patched releases verify that a port requested through the localhost port-proxy belongs to the requesting user\u0027s session.\u003c/p\u003e"
}
],
"value": "Upgrade to Posit Workbench 2026.08.0 or later, or RStudio Server 2026.08.0 or later. The patched releases verify that a port requested through the localhost port-proxy belongs to the requesting user\u0027s session."
}
],
"source": {
"discovery": "EXTERNAL"
},
"timeline": [
{
"lang": "en",
"time": "2026-05-22T00:00:00.000Z",
"value": "Reported to Posit through coordinated disclosure"
},
{
"lang": "en",
"time": "2026-05-22T00:00:00.000Z",
"value": "Reproduced internally with a working proof of concept against Posit Workbench 2025.09"
},
{
"lang": "en",
"time": "2026-07-22T00:00:00.000Z",
"value": "CVE submission and security advisory approved by Posit"
}
],
"title": "RStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cp\u003eUntil the patched release is applied, operators of multi-user instances can reduce exposure by separating sensitive workloads onto dedicated hosts or per-user isolated environments rather than sharing a single multi-user node; avoiding co-location of sensitive network services on hosts that also run user sessions; and limiting shared-server access to mutually trusted user populations where separation is not yet feasible. There is no setting that restricts the port-proxy without also disabling application proxying.\u003c/p\u003e"
}
],
"value": "Until the patched release is applied, operators of multi-user instances can reduce exposure by separating sensitive workloads onto dedicated hosts or per-user isolated environments rather than sharing a single multi-user node; avoiding co-location of sensitive network services on hosts that also run user sessions; and limiting shared-server access to mutually trusted user populations where separation is not yet feasible. There is no setting that restricts the port-proxy without also disabling application proxying."
}
],
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "8c484e69-127d-402b-9cdb-5f86ef43eb86",
"assignerShortName": "POSIT",
"cveId": "CVE-2026-121880",
"datePublished": "2026-11-06T15:10:37.306Z",
"dateReserved": "2026-11-04T10:49:21.246Z",
"dateUpdated": "2026-11-06T17:45:27.737Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}