JetBrains GoLand CVE-2026-64800

Exploitation requires that the developer has used GoLand (before 2026.2) to open or interact with a project containing sensitive configuration values - this is the default behavior and requires no special configuration to trigger. The attacker must then obtain read access to GoLand's log files either via local filesystem access on the developer's machine, access to a CI/CD build host where GoLand runs in automated mode, or read access to a centralized log aggregation system receiving IDE log output. The CVSS UI:R metric reflects that a developer must actively use the IDE to cause logging to occur; the IDE does not log passively without interaction. Exploitation is bounded to Confidentiality impact only - no code execution, no integrity modification, and no availability impact applies. Environments where GoLand logs remain on the local developer workstation with standard user-only permissions face significantly lower external exposure than CI/CD or remote-development deployments.

The CVSS 3.1 score of 3.5 (Low) is internally consistent: Confidentiality:Low, Integrity:None, Availability:None with Scope:Unchanged accurately characterize an information disclosure limited to log file exposure. The PR:L metric confirms that exploitation requires an authenticated user context, and UI:R confirms a user must actively interact with the IDE to trigger the logging behavior - neither passive nor unauthenticated exploitation paths apply. No EPSS score was provided in the available data; no KEV listing exists; no public proof-of-concept has been identified. These signals collectively support treating this as a low-urgency hygiene issue rather than an active threat. Real-world risk escalates in specific deployment patterns: CI/CD pipelines running GoLand in headless or automated modes on shared build hosts, and environments that forward IDE logs to centralized SIEM or log aggregation platforms (ELK, Splunk, Datadog) where log readers may be broader than the developer audience. The vendor-assigned AV:N is notable - this analyst assesses AV:L as more representative of typical desktop IDE deployments, though JetBrains' remote development capabilities (JetBrains Gateway) may have informed the network vector assignment.

A developer opens a Go project containing cloud provider credentials or VCS tokens in GoLand before 2026.2; the IDE writes these values to its log files during routine use. A threat actor who has compromised the developer workstation, obtained access to a shared build server running GoLand in CI mode, or gained read access to a centralized log aggregation platform extracts the plaintext credentials from log entries and uses them to access the targeted remote service. No proof-of-concept exploit code has been identified at the time of analysis.