---
id: "CVE-2026-118696"
kind: "vulnerability"
aliases: ["CVE-2026-118696"]
title: "JetBrains IDEs: embedded browser trusts revoked intermediate certificates"
severity: "high"
cvss: 8.0
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["clion", "datagrip", "dataspell", "goland", "intellij-idea", "jetbrains", "other", "phpstorm", "pycharm", "rider", "rubymine", "rustrover", "webstorm"]
not_affected_if: ["default-config"]
published_at: "2026-10-30T18:17:24+00:00"
first_seen_at: "2026-10-30T18:55:29+00:00"
updated_at: "2026-10-30T18:56:39+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118696", "first_seen_at": "2026-10-30T18:55:29+00:00"}]
---

# JetBrains IDEs: embedded browser trusts revoked intermediate certificates

Several JetBrains IDEs ship an embedded browser that keeps trusting intermediate certificates after they were revoked. An attacker who can present a site using such a certificate could be trusted by the IDE's browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed IDE version under Help > About and compare it with the fixed versions in the sources.

## Fix

- IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm: `2026.3`, `2026.2.4`, `2026.1.5.1`, or `2025.3.6.2`
- GoLand: `2026.3`, `2026.2.4`, `2026.1.5.1`, or `2025.3.5.2`
- Rider: `2026.3`, `2026.2.4`, `2026.1.5.3`, or `2025.3.5.3`
- CLion: `2026.3`, `2026.2.4.1`, `2026.1.5.2`, or `2025.3.6.3`
- DataGrip: `2026.3`, `2026.2.6.1`, `2026.1.4.1`, or `2025.3.6.1`
- RustRover: `2026.3`, `2026.2.5`, `2026.1.4.1`, or `2025.3.7.1`
- DataSpell: `2026.1.3.1` or `2025.3.3.1`

## Timeline

- 2026-10-30T18:55:29+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118696

## From the sources

In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, and 2025.3.6.3; DataGrip before 2026.3, 2026.2.6.1, 2026.1.4.1, and 2025.3.6.1; RustRover before 2026.3, 2026.2.5, 2026.1.4.1, and 2025.3.7.1; DataSpell before 2026.1.3.1 and 2025.3.3.1, the embedded browser trusted revoked intermediate certificates

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_