CVE-2026-123312 · Other
NO FIX YET · SEE WHAT TO DO
Before IntelliJ IDEA 2026.3 and 2026.2.4, a crafted annotations.xml file could make the IDE send requests to addresses the attacker chooses during indexing. An attacker could use this to reach internal services from a developer's machine.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Developers who open untrusted projects in IntelliJ IDEA versions before 2026.3 or 2026.2.4 are the ones exposed, because indexing reads annotations.xml files. The sources do not say whether any non-default configuration is needed. Teams that only open their own trusted projects are at lower risk.
Not affected if fixed-version, trusted-projects-only
Who cares intellij-idea, java, jetbrains, kotlin
2026.3 or 2026.2.4; the sources state these as the fixed versions.In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml files during indexing
This page as .md · .json · CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.