{"id":"CVE-2026-123312","kind":"vulnerability","aliases":["CVE-2026-123312"],"related":[],"title":"JetBrains IntelliJ IDEA: opening project files can trigger server-side request forgery","description":"In JetBrains IntelliJ IDEA before 2026.3, \n2026.2.4 sSRF was possible via annotations.xml files during indexing","summary":"Before IntelliJ IDEA 2026.3 and 2026.2.4, a crafted annotations.xml file could make the IDE send requests to addresses the attacker chooses during indexing. An attacker could use this to reach internal services from a developer's machine.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["intellij-idea","java","jetbrains","kotlin","other"],"not_affected_if":["fixed-version","trusted-projects-only"],"how_to_check":"- Check the installed IntelliJ IDEA version under Help > About.","fix":"- Upgrade IntelliJ IDEA to `2026.3` or `2026.2.4`; the sources state these as the fixed versions.","status":"open","published_at":"2026-11-06T11:17:10+00:00","first_seen_at":"2026-11-06T11:41:26+00:00","triaged_at":"2026-11-06T11:42:47+00:00","updated_at":"2026-11-06T11:42:47+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-06T11:42:47Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade IntelliJ IDEA to `2026.3` or `2026.2.4`; the sources state these as the fixed versions.","reach":"local","title":"JetBrains IntelliJ IDEA: opening project files can trigger server-side request forgery","impact":"low","summary":"Before IntelliJ IDEA 2026.3 and 2026.2.4, a crafted annotations.xml file could make the IDE send requests to addresses the attacker chooses during indexing. An attacker could use this to reach internal services from a developer's machine.","audience":"developers","category":"other","nicknames":[],"who_cares":["intellij-idea","jetbrains","java","kotlin"],"confidence":0.5,"fix_status":"available","needs_auth":"no","worst_case":"Attacker makes the IDE send requests to internal services","analyst_note":"","how_to_check":"- Check the installed IntelliJ IDEA version under Help > About.\n- unknown for other checks; the sources do not say.","plain_action":"","needs_analyst":false,"not_affected_if":["trusted-projects-only","fixed-version"],"who_is_affected":"Developers who open untrusted projects in IntelliJ IDEA versions before 2026.3 or 2026.2.4 are the ones exposed, because indexing reads annotations.xml files. The sources do not say whether any non-default configuration is needed. Teams that only open their own trusted projects are at lower risk.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000685,"input_tokens":4188,"output_tokens":533,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-123312':16A,19A '-2026':15A,18A '2026.2.4':31B,69C '2026.3':29B,68C 'address':43B 'annotations.xml':34B,74C 'attack':45B,50B 'choos':46B 'could':36B,51B 'craft':33B 'cve':14A,17A 'develop':60B 'file':6A,35B,75C 'forgeri':13A 'ide':39B 'idea':3A,22B,28B,66C 'index':48B,77C 'intellij':2A,21B,27B,65C 'intellij-idea':20B 'intern':56B 'java':23B 'jetbrain':1A,24B,64C 'kotlin':25B 'machin':62B 'make':37B 'open':4A 'possibl':72C 'project':5A 'reach':55B 'request':12A,41B 'send':40B 'server':10A 'server-sid':9A 'servic':57B 'side':11A 'ssrf':70C 'trigger':8A 'use':52B 'via':73C","nicknames":[],"mitigations":[],"who_affected":"Developers who open untrusted projects in IntelliJ IDEA versions before 2026.3 or 2026.2.4 are the ones exposed, because indexing reads annotations.xml files. The sources do not say whether any non-default configuration is needed. Teams that only open their own trusted projects are at lower risk.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["intellijidea","java","jetbrains","kotlin","low","other"],"campaign_type":null,"search_a":"'-123312':16A,19A '-2026':15A,18A 'cve':14A,17A 'file':6A 'forgeri':13A 'idea':3A 'intellij':2A 'jetbrain':1A 'open':4A 'project':5A 'request':12A 'server':10A 'server-sid':9A 'side':11A 'trigger':8A","search_b":"'2026.2.4':31B '2026.3':29B 'address':43B 'annotations.xml':34B 'attack':45B,50B 'choos':46B 'could':36B,51B 'craft':33B 'develop':60B 'file':35B 'ide':39B 'idea':22B,28B 'index':48B 'intellij':21B,27B 'intellij-idea':20B 'intern':56B 'java':23B 'jetbrain':24B 'kotlin':25B 'machin':62B 'make':37B 'reach':55B 'request':41B 'send':40B 'servic':57B 'use':52B","search_c":"'2026.2.4':69C '2026.3':68C 'annotations.xml':74C 'file':75C 'idea':66C 'index':77C 'intellij':65C 'jetbrain':64C 'possibl':72C 'ssrf':70C 'via':73C","first_public_at":"2026-11-06T11:17:10+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123312","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123312","severity":null,"published_at":"2026-11-06T11:17:10+00:00","modified_at":"2026-11-06T11:17:10+00:00","first_seen_at":"2026-11-06T11:41:26+00:00","fetched_at":"2026-11-06T11:41:26+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}