Authentication Bypass in JetBrains GoLand Profiler Exposes Sensitive Profiling Data
CVE-2026-86506

5.9MEDIUM

Key Information:

Vendor

Jetbrains
Status
Goland
Vendor
CVE Published:
7 September 2026

What is CVE-2026-86506?

A vulnerability exists in JetBrains GoLand prior to version 2026.2.2.1, where a missing authentication feature on the GoLand profiler's injected pprof server allows unauthorized access to sensitive profiling data. This flaw could potentially expose system profiling information, posing security risks to users who rely on the software for application development. It's crucial for organizations to upgrade to the latest version to mitigate this risk.

Affected Version(s)

GoLand 0 < 2026.2.2.1

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
5.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.