CVE-2026-123306 · Package
NO FIX YET · SEE WHAT TO DO
In JetBrains IntelliJ IDEA before 2026.3, improper checks let server certificates be added to the trust store during headless runs. An attacker positioned on the network path could get the IDE to trust a server it should reject.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Teams running IntelliJ IDEA before 2026.3 in headless mode, such as CI or build jobs that use it for automated runs. Interactive desktop use of the IDE is described by the sources only as the headless case, so unknown beyond that.
Not affected if interactive-only-use, version-2026.3-or-later
Who cares ci, intellij-idea, jetbrains
2026.3 are affected.2026.3In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.