JetBrains YouTrack CVE-2026-86485

Bitbucket webhook integration must be configured and active in the YouTrack instance. The webhook endpoint must be reachable by the attacker over the network (typically HTTPS on port 443 or the configured YouTrack port). The attacker must be able to inject or control an HTTP header such as X-Forwarded-For in transit - achievable by directly sending HTTP requests without passing through a header-stripping proxy. No authentication is required to submit webhook events to the endpoint. Exploitation is limited to YouTrack versions before 2026.2.18634; instances running the patched build or not using Bitbucket integration are not exposed.

The vendor-assigned CVSS score of 3.5 (Low) reflects limited real-world impact: the attacker can cause YouTrack to process a forged webhook event (integrity impact), but cannot directly read data or crash the service. EPSS data and KEV status are absent from the input, and no public exploit has been identified, reinforcing a low exploitation-probability assessment. One notable discrepancy: the vendor's CVSS vector encodes AV:L (local) and UI:R (user interaction required), which is difficult to reconcile with an HTTP-header-injection attack against a network-accessible webhook endpoint - AV:N and UI:N would better match the described mechanism. This inconsistency means the 3.5 score may not accurately reflect the attack surface. Practically, exploitation is constrained by needing to know the specific webhook URL and having network access to the YouTrack instance, limiting opportunistic mass exploitation. No public exploit code exists and there is no KEV listing, making this a low immediate priority for most organizations but warranting prompt patching given the straightforward attack path once an endpoint is identified.

An attacker who has discovered a YouTrack instance with Bitbucket integration enabled sends a crafted HTTP POST to the webhook endpoint, setting X-Forwarded-For to a known Bitbucket IP address. YouTrack's webhook handler accepts the spoofed header as proof of legitimate origin and processes the attacker-supplied payload as a genuine Bitbucket event, potentially triggering automated workflow actions (issue creation, state changes) based entirely on attacker-controlled data. No exploit code is publicly available at this time.