EUVD-2026-60252
GHSA-6v6x-gp82-9jqj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Agrees with vendor vector: network-reachable SSRF with user interaction, no authentication, limited and scoped confidentiality and integrity impact, no availability harm.
Primary rating from Vendor (jetbrains).
CVSS VectorVendor: jetbrains
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint
AnalysisAI
Server-Side Request Forgery in JetBrains IntelliJ IDEA before version 2026.2.1 allows network-accessible attackers to coerce the IDE into issuing arbitrary HTTP requests via the DevKit debug listener endpoint, requiring user interaction to trigger. The vulnerability carries a CVSS 5.4 (Medium) score with low confidentiality and integrity impact, and no availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerability is triggered through the DevKit debug listener endpoint, which is a component of the IntelliJ Platform Plugin DevKit - meaning the DevKit plugin must be present and active in the IDE installation. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 5.4 Medium score is broadly consistent with the realistic impact: SSRF with low C and I impact and unchanged scope limits the blast radius. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker hosts a malicious IntelliJ project file or crafts a URL that, when a developer opens or interacts with it in IntelliJ IDEA, causes the DevKit debug listener endpoint to issue an HTTP request to an attacker-chosen target - such as the AWS EC2 metadata service at 169.254.169.254 or an internal corporate API endpoint. The attacker retrieves the response, potentially harvesting cloud credentials or enumerating internal services. … |
| Remediation | Upgrade IntelliJ IDEA to version 2026.2.1 or later, which JetBrains identifies as the fix release per the security bulletin at https://www.jetbrains.com/privacy-security/issues-fixed/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today