RStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership
Summary
| CVE | CVE-2026-121880 |
|---|---|
| State | PUBLISHED |
| Assigner | POSIT |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-11-06 16:17:52 UTC |
| Updated | 2026-11-06 18:18:00 UTC |
| Description | Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session. NOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying. |
Risk And Classification
Primary CVSS: v4.0 4.7 MEDIUM from 8c484e69-127d-402b-9cdb-5f86ef43eb86
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:M/U:Amber
Problem Types: CWE-639 | CWE-862 | CWE-639 CWE-639 Authorization Bypass Through User-Controlled Key | CWE-862 CWE-862 Missing Authorization
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | 8c484e69-127d-402b-9cdb-5f86ef43eb86 | Secondary | 4.7 | MEDIUM | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/C... |
| 4.0 | CNA | CVSS | 4.7 | MEDIUM | CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/A... |
CVSS v4.0 Breakdown
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:M/U:Amber
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Posit Software PBC | Posit Workbench | affected 2026.08.0 custom | Linux |
| CNA | Posit Software PBC | RStudio Server | affected 2026.08.0 custom | Linux |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| docs.posit.co/ide/news | 8c484e69-127d-402b-9cdb-5f86ef43eb86 | docs.posit.co | |
| trust.posit.co/updates | 8c484e69-127d-402b-9cdb-5f86ef43eb86 | trust.posit.co | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Luiz Felipe Mol (confu53) (en)
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| CNA | 2026-05-22T00:00:00.000Z | Reported to Posit through coordinated disclosure |
| CNA | 2026-05-22T00:00:00.000Z | Reproduced internally with a working proof of concept against Posit Workbench 2025.09 |
| CNA | 2026-07-22T00:00:00.000Z | CVE submission and security advisory approved by Posit |
Solutions
CNA: Upgrade to Posit Workbench 2026.08.0 or later, or RStudio Server 2026.08.0 or later. The patched releases verify that a port requested through the localhost port-proxy belongs to the requesting user's session.
Workarounds
CNA: Until the patched release is applied, operators of multi-user instances can reduce exposure by separating sensitive workloads onto dedicated hosts or per-user isolated environments rather than sharing a single multi-user node; avoiding co-location of sensitive network services on hosts that also run user sessions; and limiting shared-server access to mutually trusted user populations where separation is not yet feasible. There is no setting that restricts the port-proxy without also disabling application proxying.