JetBrains YouTrack CVE-2026-100279

Requires an authenticated YouTrack account with permission to modify an existing integration's configuration URL (the CVSS PR:L indicates low but non-zero privileges - not anonymous access). Exploitation is triggered by editing the integration's URL to point at an attacker-controlled endpoint, after which YouTrack discloses the integration's stored credentials by sending them to that URL. Limiting factors: only environments that grant lower-trust users the ability to edit integration settings are meaningfully at risk; instances where integration configuration is restricted to trusted administrators face reduced exposure. No end-user interaction (UI:N) beyond the attacker's own action is needed, and only versions before 2026.2.19197 are affected.

The CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity, low-privilege flaw with high confidentiality impact and no integrity or availability effect - consistent with a credential-disclosure bug rather than a code-execution or takeover issue. No EPSS score, CISA KEV listing, POC, or SSVC decision data was supplied, so all exploitation-likelihood signals are absent; on available evidence this is 'no public exploit identified at time of analysis.' The vulnerability was self-reported by the vendor (JetBrains) and a patch is available, which typically indicates coordinated disclosure without observed in-the-wild abuse. One signal worth flagging: the assigned CWE-918 (SSRF) and the 'SSRF' tag describe the delivery mechanism (redirecting an integration's outbound request to an attacker endpoint), but the actual, primary impact is credential exposure (closer to CWE-522) - the C:H/I:N/A:N vector reflects disclosure, not classic internal-network SSRF pivoting, so treat the SSRF framing as mechanism-only. Realistic priority is low-to-medium: exploitation requires an existing authenticated foothold able to edit an integration's URL, limiting blast radius to environments where lower-trust users can reach integration configuration.

An authenticated YouTrack user with permission to edit an integration's configuration changes the integration's target URL to an attacker-controlled server. When YouTrack next connects using that integration, it transmits the stored credentials to the attacker's endpoint, disclosing them in the request. No public exploit code is identified, and no user interaction beyond the attacker's own configuration change is required.