JetBrains Hub EUVD-2026-72496

Exploitation requires network reachability to the JetBrains Hub service-registration interface of a vulnerable instance (version before 2026.2.52442); per the CVSS vector (PR:N/UI:N/AC:L) no authentication, user interaction, or special configuration is needed against a default deployment. The primary limiting factor is network exposure: instances confined to an internal network, VPN, or IP allowlist are only reachable by attackers with that network position, whereas internet-facing Hub servers are fully exposed. No specific non-default feature toggle is called out in the description - trusted-service registration is core Hub functionality.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, base 9.8) aligns cleanly with the description - a remote, unauthenticated, low-complexity path to superuser gives full confidentiality, integrity, and availability impact, and this is well supported by CWE-306 for a critical function. No EPSS score, KEV listing, or POC indicator is present in the input, so there is no evidence of active or automated exploitation yet; the severity here derives from potential impact rather than confirmed in-the-wild activity. Given Hub's role as an SSO hub, superuser takeover is effectively a keys-to-the-kingdom outcome, so even a mid-sized municipal IT team should treat an exposed, unpatched Hub instance as an urgent patch priority regardless of the currently unknown EPSS/exploit signals. Note the only reference is a generic JetBrains 'issues-fixed' page rather than a dedicated per-CVE advisory, so exact exploitation details are not independently verifiable from the provided data.

An attacker who can reach the Hub HTTP interface sends a crafted request to the service-registration endpoint without any credentials, registering a new trusted service that is granted superuser scope. Using that trusted-service identity, the attacker mints tokens or authorizes itself as an administrator and pivots into connected JetBrains applications (YouTrack, TeamCity) that rely on Hub for authentication. No POC is identified in the provided data, but the low attack complexity and lack of authentication make exploitation straightforward once the endpoint is exposed.