IntelliJ IDEA EUVD-2026-60252

The vulnerability is triggered through the DevKit debug listener endpoint, which is a component of the IntelliJ Platform Plugin DevKit - meaning the DevKit plugin must be present and active in the IDE installation. User interaction is required (CVSS UI:R), so the attack cannot be fully automated; the developer must perform some action such as opening a crafted project, importing content, or interacting with a link that invokes the endpoint. The attacker must be able to deliver this triggering content to the victim - for example via a malicious repository, a shared project file, or a crafted URL. Exploitation is limited to IntelliJ IDEA versions strictly before 2026.2.1. The SSRF does not provide code execution or elevated OS privileges - scope remains unchanged (S:U) - so post-exploitation impact depends entirely on what internal HTTP services are reachable from the developer's network segment.

The CVSS 5.4 Medium score is broadly consistent with the realistic impact: SSRF with low C and I impact and unchanged scope limits the blast radius. AV:N/AC:L/PR:N/UI:R indicates network reachable with low complexity and no required attacker authentication, but user interaction is a genuine friction point that reduces automated exploitability. The unchanged scope (S:U) means the SSRF cannot directly pivot into full remote code execution on the host; harm is limited to probing internal infrastructure, leaking metadata service tokens, or triggering actions on internal HTTP services. No EPSS data was provided in the input, so exploitation probability cannot be quantified. No KEV listing and no POC availability further reduce near-term priority. The DevKit debug listener is a developer-tooling feature rather than a production server component, which may limit the attack surface to development machines and CI environments - environments that often have broad internal network access, elevating the potential value of an SSRF originating from them. The missing EPSS score and absence of vendor patch version details are gaps that limit full confidence in this assessment.

An attacker hosts a malicious IntelliJ project file or crafts a URL that, when a developer opens or interacts with it in IntelliJ IDEA, causes the DevKit debug listener endpoint to issue an HTTP request to an attacker-chosen target - such as the AWS EC2 metadata service at 169.254.169.254 or an internal corporate API endpoint. The attacker retrieves the response, potentially harvesting cloud credentials or enumerating internal services. No public POC has been identified at time of analysis.