{"id":"CVE-2026-123307","kind":"vulnerability","aliases":["CVE-2026-123307"],"related":[],"title":"JetBrains IntelliJ IDEA: unauthenticated connection to arbitrary host via run configurations","description":"In JetBrains IntelliJ IDEA before 2026.3, \n2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possible","summary":"Before IntelliJ IDEA 2026.3 and 2026.2.4, run configurations could make the IDE connect to an arbitrary host without authentication. An attacker who can supply a run configuration can use the IDE to reach hosts of their choosing.","severity":"medium","cvss":6.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developer-workstation","intellij-idea","jetbrains","package"],"not_affected_if":["patched-version"],"how_to_check":"- Check the IntelliJ IDEA version under Help > About, or run `idea --version` if available.\n- Confirm whether the installed version is earlier than `2026.3` or `2026.2.4`.","fix":"- JetBrains IntelliJ IDEA: move to `2026.3` or `2026.2.4`.","status":"open","published_at":"2026-11-06T11:17:09+00:00","first_seen_at":"2026-11-06T11:41:25+00:00","triaged_at":"2026-11-06T11:42:14+00:00","updated_at":"2026-11-06T11:42:14+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-06T11:42:14Z","model":"claude-haiku-5-5","output":{"fix":"- JetBrains IntelliJ IDEA: move to `2026.3` or `2026.2.4`.","reach":"unknown","title":"JetBrains IntelliJ IDEA: unauthenticated connection to arbitrary host via run configurations","impact":"low","summary":"Before IntelliJ IDEA 2026.3 and 2026.2.4, run configurations could make the IDE connect to an arbitrary host without authentication. An attacker who can supply a run configuration can use the IDE to reach hosts of their choosing.","audience":"developers","category":"package","nicknames":[],"who_cares":["intellij-idea","jetbrains","developer-workstation"],"confidence":0.5,"fix_status":"available","needs_auth":"no","worst_case":"IDE connects to an attacker-chosen host, leaking data or probing networks","analyst_note":"Confirm the exact trigger for run configurations and whether the JetBrains advisory describes data exposure; the NVD entry alone is thin.","how_to_check":"- Check the IntelliJ IDEA version under Help > About, or run `idea --version` if available.\n- Confirm whether the installed version is earlier than `2026.3` or `2026.2.4`.","plain_action":"","needs_analyst":true,"not_affected_if":["patched-version"],"who_is_affected":"Developers who run IntelliJ IDEA versions before 2026.3 or 2026.2.4 and open projects with run configurations from untrusted sources. The sources do not describe the exact conditions, so the team should confirm the trigger before deciding urgency. Teams that only use patched versions can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":4194,"output_tokens":596,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123307':14A,17A '-2026':13A,16A '2026.2.4':31B,69C '2026.3':29B,68C 'arbitrari':7A,41B,74C 'attack':46B 'authent':44B 'choos':62B 'configur':11A,33B,52B,78C 'connect':5A,38B,71C 'could':34B 'cve':12A,15A 'develop':19B 'developer-workst':18B 'host':8A,42B,59B,75C 'ide':37B,56B 'idea':3A,23B,28B,66C 'intellij':2A,22B,27B,65C 'intellij-idea':21B 'jetbrain':1A,24B,64C 'make':35B 'packag':25B 'possibl':80C 'reach':58B 'run':10A,32B,51B,77C 'suppli':49B 'unauthent':4A,70C 'use':54B 'via':9A,76C 'without':43B 'workstat':20B","nicknames":[],"mitigations":[],"who_affected":"Developers who run IntelliJ IDEA versions before 2026.3 or 2026.2.4 and open projects with run configurations from untrusted sources. The sources do not describe the exact conditions, so the team should confirm the trigger before deciding urgency. Teams that only use patched versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["developerworkstation","intellijidea","jetbrains","medium","package"],"campaign_type":null,"search_a":"'-123307':14A,17A '-2026':13A,16A 'arbitrari':7A 'configur':11A 'connect':5A 'cve':12A,15A 'host':8A 'idea':3A 'intellij':2A 'jetbrain':1A 'run':10A 'unauthent':4A 'via':9A","search_b":"'2026.2.4':31B '2026.3':29B 'arbitrari':41B 'attack':46B 'authent':44B 'choos':62B 'configur':33B,52B 'connect':38B 'could':34B 'develop':19B 'developer-workst':18B 'host':42B,59B 'ide':37B,56B 'idea':23B,28B 'intellij':22B,27B 'intellij-idea':21B 'jetbrain':24B 'make':35B 'packag':25B 'reach':58B 'run':32B,51B 'suppli':49B 'use':54B 'without':43B 'workstat':20B","search_c":"'2026.2.4':69C '2026.3':68C 'arbitrari':74C 'configur':78C 'connect':71C 'host':75C 'idea':66C 'intellij':65C 'jetbrain':64C 'possibl':80C 'run':77C 'unauthent':70C 'via':76C","first_public_at":"2026-11-06T11:17:09+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123307","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123307","severity":null,"published_at":"2026-11-06T11:17:09+00:00","modified_at":"2026-11-06T11:17:09+00:00","first_seen_at":"2026-11-06T11:41:25+00:00","fetched_at":"2026-11-06T11:41:25+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}