JetBrains GoLand CVE-2026-86506

The GoLand profiler must be actively running on the target host - the injected pprof HTTP server does not exist outside of active profiling sessions, meaning exploitation is bounded to the window when a developer is actively using the GoLand profiler feature. The attacker requires network-level connectivity to the specific port on which GoLand injects the pprof server; this port must not be blocked by host-based or network firewalls. No credentials, authentication tokens, or special protocol knowledge are required beyond the ability to issue HTTP GET requests. Exploitation is further bounded by the transient nature of profiling sessions: once the session ends, the server is removed. The AC:H CVSS metric reflects these combined prerequisites of session-timing and network-positioning, distinguishing this from a persistently exposed, always-on service.

The CVSS 5.9 score (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N) accurately reflects a constrained but high-consequence confidentiality exposure - the AC:H rating captures the core limiting factor: the pprof server only exists during active GoLand profiling sessions, so exploitation requires both network access and correct timing relative to the developer's workflow. There is no integrity or availability impact. EPSS data is not provided in the input, and this vulnerability is not listed in CISA KEV. No public exploit code has been identified at time of analysis. Real-world risk is shaped almost entirely by deployment context: developers running GoLand on firewalled corporate workstations face minimal exposure, while those profiling on machines reachable from broader networks - including CI/CD runners or cloud development environments - face meaningful risk. Even a mid-sized municipal IT team in zabrze should treat this as a routine patch rather than an emergency, given the AC:H session-timing constraint, but Go shops running profiling on internet-adjacent infrastructure should prioritize the upgrade. CVSS correctly scopes impact to the vulnerable system with no lateral movement implied.

An attacker on the same network segment as a developer running a GoLand profiling session identifies the pprof server port (by scanning common pprof ports or observing network traffic) and issues a simple HTTP GET request to /debug/pprof/heap, receiving a full heap dump of the profiled application. If the application under profiling is processing authentication tokens, database credentials, or user PII at the time of the request, that data is present in the heap dump and immediately readable. No exploit tooling is required beyond curl or a web browser.