EUVD-2026-48226
GHSA-mq5x-hhj4-5pj3
Severity by source
AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N
GoLand is a desktop IDE writing logs to local disk; AV:L better reflects typical access requirements than vendor-assigned AV:N, absent remote-development context.
Primary rating from Vendor (jetbrains).
CVSS VectorNVD
Lifecycle Timeline
4DescriptionNVD
In JetBrains GoLand before 2026.2 sensitive configuration values written to log files by default
AnalysisAI
JetBrains GoLand before version 2026.2 writes sensitive configuration values to log files by default, exposing credentials and secrets to anyone with read access to IDE log output. The CWE-532 flaw affects Go developers whose project configurations contain API keys, VCS credentials, or cloud tokens - values the IDE silently captures in plaintext log entries during normal use. No active exploitation has been confirmed (not in CISA KEV) and no public proof-of-concept exists; the low CVSS score of 3.5 reflects the limited impact and the requirement for low privilege and user interaction.
Technical ContextAI
CWE-532 (Insertion of Sensitive Information into Log File) is a logging hygiene vulnerability class where an application writes security-sensitive data - passwords, API tokens, private keys, database connection strings - to log output without masking or redaction. JetBrains GoLand is a dedicated Go-language IDE whose configuration subsystem handles project settings that routinely include sensitive remote-service credentials, version control authentication tokens, and cloud provider keys. Prior to version 2026.2, the IDE's default logging verbosity captured these values in plaintext, making them readable to any principal with access to the log directory or a downstream log aggregation pipeline. No CPE string was included in the available intelligence data; affected product scope is derived solely from the NVD description and the JetBrains advisory.
RemediationAI
Upgrade JetBrains GoLand to version 2026.2 or later - this is the vendor-confirmed fix release per the advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. As an immediate compensating control prior to patching, restrict filesystem read permissions on GoLand log directories (typically ~/.cache/JetBrains/GoLand/ on Linux/macOS or %APPDATA%\JetBrains\GoLand\ on Windows) to the owning developer account, preventing lateral access from other local users or automated processes. If logs are shipped to a centralized logging system, apply field-level redaction or masking rules at the log shipper (e.g., Filebeat, Fluentd) for common sensitive patterns such as password=, token=, secret=, and apiKey= - note this may reduce log fidelity for debugging purposes. Rotate any credentials or API keys that may have been captured in existing pre-patch log files, particularly for shared service accounts used across multiple projects.
Remote code execution in JetBrains GoLand before 2026.1.3 lets an attacker run arbitrary code on a developer's machine w
Arbitrary code execution in JetBrains GoLand IDE before version 2026.2 allows a malicious project to run attacker-contro
Arbitrary code execution in JetBrains GoLand before 2026.2 allows a malicious Go project to run attacker-controlled code
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ
In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS. Rated high severity (
Unauthenticated network exposure of Go runtime profiling data affects JetBrains GoLand IDE versions prior to 2026.2.2.1,
In JetBrains GoLand before 2025.1 an XXE during debugging was possible. Rated medium severity (CVSS 4.1), this vulnerabi
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today