PSA-2026-0002: Session isolation bypass in the RStudio Server and Posit Workbench localhost port-proxy

Security
Posit Security Advisory (PSA) for an authorization bypass in the localhost port-proxy (/p/ and /p6/ URLs) in RStudio Server and Posit Workbench
Published

November 6, 2026

Source advisory: RStudio and Workbench 2026.08.0 release notes

Common Vulnerabilities and Exposures (CVE) ID: CVE-2026-121880

Common Weakness Enumeration (CWE): CWE-639 (Authorization Bypass Through User-Controlled Key)

Severity: Medium, with a Common Vulnerability Scoring System (CVSS) v4.0 score of 5.7 (CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N)

Affected versions: Workbench and RStudio Server, all releases through 2026.07.1

Fixed version: 2026.08.0

Description

An authorization bypass exists in the localhost port-proxy (/p/ and /p6/ URLs) in RStudio Server and Workbench through 2026.07.1. An authenticated user on a multi-user server can reach web applications and other services that another user’s session binds to 127.0.0.1. The attacker can also view that user’s live rendered content and data. To do this, the attacker builds a proxy URL from their own port token and an arbitrary port number, and finds target ports by scanning.

The port token is an obfuscation measure, and the documentation describes it as not cryptographically secure. The proxy does not verify that the requested port belongs to the requesting user’s session. Attackers can reach root-owned listeners on the same host the same way, such as ports that rootful Docker or system services publish.

Note

Exploitation requires an authenticated account on the same multi-user server. It also requires a target service listening on localhost at the time of access. This issue does not affect single-user instances.

On hosts that co-locate other privileged services on localhost, the impact is higher than the base score reflects. The impact depends on which services are running and how you configure them. Setting allow-shell=false does not prevent the bypass.

Resolution

Upgrade Workbench or RStudio Server to 2026.08.0 or later by installing the new version over the existing installation. For full steps, see Upgrade Workbench. For example, on Ubuntu or Debian:

Terminal
curl -O https://download2.rstudio.org/server/jammy/amd64/rstudio-workbench-2026.08.0-amd64.deb
sudo apt-get install ./rstudio-workbench-2026.08.0-amd64.deb

From 2026.08.0, the server verifies that the requesting user owns the localhost port that a proxied request targets. Otherwise, the server returns HTTP 403 Forbidden.

Two conditions leave an upgraded server exposed. Check for both after upgrading:

  • The rserver.conf option www-proxy-localhost-verify-port-owner=false restores the original unverified behavior. Do not set this option.
  • On systems where the kernel’s NETLINK_SOCK_DIAG facility is unavailable, the server cannot determine port ownership. In that case, the server logs a warning and retains the previous behavior. These deployments remain affected after upgrading and need the hardening steps that follow.

No configuration workaround fully mitigates this issue on affected versions. No setting restricts the port-proxy without also disabling application proxying for Shiny, Plumber, and similar applications. If you cannot upgrade immediately, reduce exposure in the following ways:

  • Move sensitive workloads onto dedicated hosts or per-user isolated environments instead of a shared multi-user node.
  • Do not co-locate other sensitive network services on hosts that run user sessions.
  • Limit shared-server access to mutually trusted users.

Credit

Reported by Luiz Felipe Mol (confu53).

Back to top