posit rstudio server vulnerabilities

Latest posit rstudio server CVEs

Newest publication first

1. CVE-2026-121880 RStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership

   Published 2026-11-06

   Medium·CVSS 4.7 EPSS 0.25%

   Authorization bypass through user-controlled key in the localhost port-proxy (/p/<token>/) in Posit Software, PBC RStudio Server and Posit Workbench before 2026.08.0 allows remote authenticated users to reach web applications and other services bound to 127.0.0.1 under a differen...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.