EUVD-2026-60259
GHSA-5686-8wvm-pm8w
Severity by source
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Local vector confirmed by Jupyter MCP binding to localhost; PR:N consistent with the missing authentication finding; full C/I/A impact from arbitrary code execution.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools
AnalysisAI
Code execution in JetBrains PyCharm before 2026.2.1 is possible through Jupyter MCP (Model Context Protocol) tools that expose critical functions without authentication. The root cause is CWE-306 (Missing Authentication for Critical Function) - the MCP tool surface in PyCharm's Jupyter integration fails to enforce any authentication check before executing code. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the attacker have local access to the machine running PyCharm - or network access to the MCP service port if it has been exposed beyond localhost through port forwarding, container networking, or firewall misconfiguration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS base score of 8.4 (High) with vector AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects low complexity and no privileges required, but the local attack vector (AV:L) is the critical limiting factor - exploitation requires local or network access to the MCP service endpoint, typically bound on localhost. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker with local access to a machine running an unpatched PyCharm instance - such as a shared developer workstation or a CI/CD build host - connects directly to the locally-bound Jupyter MCP server endpoint without providing any credentials. The attacker sends a crafted MCP tool invocation requesting execution of arbitrary Python code, which the server processes and executes with the privileges of the PyCharm process, granting full access to the developer's files, secrets, and credentials stored in the IDE environment. … |
| Remediation | Upgrade JetBrains PyCharm to version 2026.2.1 or later, which is the vendor-confirmed patched release per the JetBrains security advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, scan the environment to identify all PyCharm installations running versions prior to 2026.2.1, prioritizing machines used by developers with access to production code repositories and secrets management systems. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today