Toolbox App
Monthly
JetBrains Toolbox App and IntelliJ IDEA expose a certificate-validation weakness in the jetbrainsd daemon that can let an unauthenticated, network-positioned attacker with a forged certificate chaining to compromised eMudhra intermediate CAs impersonate trusted endpoints and read or modify traffic. Affected versions are Toolbox App before 3.9.1 and 3.8.2 and IntelliJ IDEA before 2026.3 and 2026.2.4; exploitation requires both such a certificate and a man-in-the-middle position, so attack complexity is high even though no authentication or user interaction is needed. No public exploit code has been identified at time of analysis, but the 9.0 severity and vendor-reported root cause make prompt patching the priority.
JetBrains Toolbox App and IntelliJ IDEA expose a certificate-validation weakness in the jetbrainsd daemon that can let an unauthenticated, network-positioned attacker with a forged certificate chaining to compromised eMudhra intermediate CAs impersonate trusted endpoints and read or modify traffic. Affected versions are Toolbox App before 3.9.1 and 3.8.2 and IntelliJ IDEA before 2026.3 and 2026.2.4; exploitation requires both such a certificate and a man-in-the-middle position, so attack complexity is high even though no authentication or user interaction is needed. No public exploit code has been identified at time of analysis, but the 9.0 severity and vendor-reported root cause make prompt patching the priority.