EUVD-2026-60253
GHSA-mw34-c6m6-g442
Severity by source
AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Local delivery via malicious project file, no attacker privileges needed, victim must open it; SSRF scope change enables confidentiality breach of out-of-scope internal resources.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects
AnalysisAI
Server-Side Request Forgery in JetBrains IntelliJ IDEA before version 2026.2.1 allows an attacker who supplies a malicious project to cause the IDE's OpenAPI preview proxy to issue HTTP requests to arbitrary internal or external endpoints. The scope change (S:C in CVSS) indicates the proxy can reach resources beyond the local machine, enabling internal network reconnaissance or credential harvesting from metadata services. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the victim to open an untrusted project in IntelliJ IDEA - the crafted project must be loaded into the IDE, providing the 'User Interaction Required' (UI:R) condition. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 6.3 (Medium) is consistent with the vector: local delivery, no privileges required of the attacker, but mandatory user interaction and a scope change driving high confidentiality impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker crafts a malicious IntelliJ IDEA project containing an OpenAPI specification with server URLs pointing to an internal network endpoint - such as a cloud provider metadata service (e.g., http://169.254.169.254/latest/meta-data/) or an internal CI/CD system. The victim clones or receives the project and opens it in IntelliJ IDEA, causing the OpenAPI preview proxy to issue an HTTP request to the attacker-controlled target. … |
| Remediation | Upgrade IntelliJ IDEA to version 2026.2.1 or later, which contains the vendor-released fix as documented at https://www.jetbrains.com/privacy-security/issues-fixed/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today