CVE-2026-121880 RStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-121880?
CVE-2026-121880 is a medium-severity vulnerability in Posit Workbench, published on 6 Nov 2026.
Official description
Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a different user's session, and to view their live rendered content and data, via a proxy URL constructed from the attacker's own port token for an arbitrary port number. The port token is a documented obfuscation measure and not an authorization boundary, and the proxy does not verify that the requested port belongs to the requesting user's session.
NOTE: exploitation requires an authenticated account on the same multi-user server and a target service listening on localhost at the time of access. Impact may be greater on hosts that co-locate additional privileged localhost services, and the bypass is not prevented by allow-shell=false; no setting restricts the port-proxy without disabling all application proxying.
Which versions are affected by CVE-2026-121880?
How do I fix CVE-2026-121880?
No fix has been published for CVE-2026-121880 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-121880 being exploited?
There is no known exploitation of CVE-2026-121880 in the wild and no public exploit code.
Sources
Also known as GHSA-45mx-vf84-77ww.