EUVD-2026-72522
GHSA-8jxj-gvvm-m2rh
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
AC:H reflects that exploitation requires both network positioning and an active profiling session; C:H captures in-memory secret exposure; I:N and A:N because pprof is read-only.
Primary rating from Vendor (JetBrains).
CVSS VectorVendor: JetBrains
Lifecycle Timeline
2DescriptionCVE.org
In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data
AnalysisAI
Unauthenticated network exposure of Go runtime profiling data affects JetBrains GoLand IDE versions prior to 2026.2.2.1, where the IDE injects a pprof HTTP server into profiled processes without any access control. An attacker with network connectivity to the developer workstation during an active profiling session can retrieve heap dumps, goroutine stacks, CPU traces, and in-memory data structures that may contain credentials, tokens, or sensitive application state. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The GoLand profiler must be actively running on the target host - the injected pprof HTTP server does not exist outside of active profiling sessions, meaning exploitation is bounded to the window when a developer is actively using the GoLand profiler feature. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.9 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects a constrained but high-consequence confidentiality exposure - the AC:H rating captures the core limiting factor: the pprof server only exists during active GoLand profiling sessions, so exploitation requires both network access and correct timing relative to the developer's workflow. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade JetBrains GoLand to version 2026.2.2.1 or later, which is the vendor-confirmed fix per the JetBrains security issues advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Remote code execution in JetBrains GoLand before 2026.1.3 lets an attacker run arbitrary code on a developer's machine w
Arbitrary code execution in JetBrains GoLand IDE before version 2026.2 allows a malicious project to run attacker-contro
Arbitrary code execution in JetBrains GoLand before 2026.2 allows a malicious Go project to run attacker-controlled code
GitHub access token could be exposed to third-party sites in JetBrains IDEs after version 2023.1 and less than: IntelliJ
In JetBrains GoLand before 2019.3.2, the plugin repository was accessed via HTTP instead of HTTPS. Rated high severity (
JetBrains GoLand before version 2026.2 writes sensitive configuration values to log files by default, exposing credentia
In JetBrains GoLand before 2025.1 an XXE during debugging was possible. Rated medium severity (CVSS 4.1), this vulnerabi
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today