---
id: "CVE-2026-123298"
page: "https://infrastack.ai/live/CVE-2026-123298"
kind: "vulnerability"
aliases: ["CVE-2026-123298"]
title: "JetBrains Hub: SMTP command injection through email verification flow"
severity: "medium"
cvss: 5.0
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["jetbrains-hub", "package", "self-hosted"]
not_affected_if: ["hub-2026.2.52556-or-later"]
published_at: "2026-11-06T11:17:08+00:00"
first_seen_at: "2026-11-06T11:41:25+00:00"
updated_at: "2026-11-06T11:42:35+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123298", "first_seen_at": "2026-11-06T11:41:25+00:00"}]
exploit_sources: []
---

# JetBrains Hub: SMTP command injection through email verification flow

Link for people: https://infrastack.ai/live/CVE-2026-123298 (this .md is for agents)

JetBrains Hub before 2026.2.52556 let an attacker inject SMTP commands through the email verification feature. The sources do not say what the injected commands can reach beyond the mail server.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Hub version in the Hub admin panel or its about page; `unknown` for the exact location in the sources.
- Confirm whether email verification is enabled in Hub's settings; `unknown` for the exact setting name.

## Fix

- JetBrains Hub: move to `2026.2.52556` or later

## Timeline

- 2026-11-06T11:41:25+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123298

## From the sources

In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_