Blind SSRF Vulnerability in JetBrains IntelliJ IDEA
CVE-2026-123846

4.3MEDIUM

Key Information:

Vendor

Jetbrains
Status
Intellij Idea
Vendor
CVE Published:
6 November 2026

What is CVE-2026-123846?

A blind Server-Side Request Forgery (SSRF) vulnerability exists in JetBrains IntelliJ IDEA versions prior to 2026.3. This vulnerability arises from the improper handling of remote references during JSON Schema validation, potentially allowing attackers to send crafted requests to internal services and access sensitive information. Users are advised to upgrade to the latest version to mitigate this risk.

Affected Version(s)

IntelliJ IDEA 0 < 2026.3

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.