{"id":"CVE-2026-123277","kind":"vulnerability","aliases":["CVE-2026-123277"],"related":[],"title":"JetBrains CLion: missing authentication leaks debug session environment to local users","description":"In JetBrains CLion before 2026.3, \n2026.2.4.1 missing authentication allowed local users to obtain the debug session environment on Linux","summary":"In JetBrains CLion before 2026.3 and 2026.2.4.1, a flaw in the debugger lets a local user obtain the debug session environment on Linux. The sources do not say what the environment contains beyond that.","severity":"medium","cvss":5.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["clion","jetbrains","linux","other"],"not_affected_if":["non-linux","single-user-machine"],"how_to_check":"- Check the CLion version under Help > About: versions before `2026.3` on the `2026.2.x` line below `2026.2.4.1` are in scope.","fix":"- JetBrains CLion: move to `2026.3` or `2026.2.4.1`, the versions named in the advisory text.","status":"open","published_at":"2026-11-06T11:17:05+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","triaged_at":"2026-11-06T11:42:37+00:00","updated_at":"2026-11-06T11:42:37+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T11:42:37Z","model":"claude-haiku-5-5","output":{"fix":"- JetBrains CLion: move to `2026.3` or `2026.2.4.1`, the versions named in the advisory text.","reach":"local","title":"JetBrains CLion: missing authentication leaks debug session environment to local users","impact":"low","summary":"In JetBrains CLion before 2026.3 and 2026.2.4.1, a flaw in the debugger lets a local user obtain the debug session environment on Linux. The sources do not say what the environment contains beyond that.","audience":"developers","category":"other","nicknames":[],"who_cares":["clion","linux","jetbrains"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"local user reads debug session environment variables from another user","analyst_note":"","how_to_check":"- Check the CLion version under Help > About: versions before `2026.3` on the `2026.2.x` line below `2026.2.4.1` are in scope.\n- unknown","plain_action":"","needs_analyst":false,"not_affected_if":["non-linux","single-user-machine"],"who_is_affected":"Only CLion users on Linux are named in the sources, and only where another local user shares the machine. Exposure depends on whether the debug session environment holds sensitive values, which the sources do not say.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000654,"input_tokens":4184,"output_tokens":471,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123277':14A,17A '-2026':13A,16A '2026.2.4.1':27B,59C '2026.3':25B,58C 'allow':62C 'authent':4A,61C 'beyond':53B 'clion':2A,18B,23B,56C 'contain':52B 'cve':12A,15A 'debug':6A,39B,68C 'debugg':32B 'environ':8A,41B,51B,70C 'flaw':29B 'jetbrain':1A,19B,22B,55C 'leak':5A 'let':33B 'linux':20B,43B,72C 'local':10A,35B,63C 'miss':3A,60C 'obtain':37B,66C 'say':48B 'session':7A,40B,69C 'sourc':45B 'user':11A,36B,64C","nicknames":[],"mitigations":[],"who_affected":"Only CLion users on Linux are named in the sources, and only where another local user shares the machine. Exposure depends on whether the debug session environment holds sensitive values, which the sources do not say.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["clion","jetbrains","linux","medium","other"],"campaign_type":null,"search_a":"'-123277':14A,17A '-2026':13A,16A 'authent':4A 'clion':2A 'cve':12A,15A 'debug':6A 'environ':8A 'jetbrain':1A 'leak':5A 'local':10A 'miss':3A 'session':7A 'user':11A","search_b":"'2026.2.4.1':27B '2026.3':25B 'beyond':53B 'clion':18B,23B 'contain':52B 'debug':39B 'debugg':32B 'environ':41B,51B 'flaw':29B 'jetbrain':19B,22B 'let':33B 'linux':20B,43B 'local':35B 'obtain':37B 'say':48B 'session':40B 'sourc':45B 'user':36B","search_c":"'2026.2.4.1':59C '2026.3':58C 'allow':62C 'authent':61C 'clion':56C 'debug':68C 'environ':70C 'jetbrain':55C 'linux':72C 'local':63C 'miss':60C 'obtain':66C 'session':69C 'user':64C","first_public_at":"2026-11-06T11:17:05+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:L","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123277","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123277","severity":null,"published_at":"2026-11-06T11:17:05+00:00","modified_at":"2026-11-06T11:17:05+00:00","first_seen_at":"2026-11-06T11:41:24+00:00","fetched_at":"2026-11-06T11:41:24+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}