---
id: "CVE-2026-123336"
page: "https://infrastack.ai/live/CVE-2026-123336"
kind: "vulnerability"
aliases: ["CVE-2026-123336"]
title: "JetBrains YouTrack: attachment size limit bypass via AI assistant thread conversion"
severity: "low"
cvss: 3.1
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["jetbrains", "runtime", "self-hosted", "youtrack"]
not_affected_if: ["already-patched"]
published_at: "2026-11-06T11:17:14+00:00"
first_seen_at: "2026-11-06T11:41:28+00:00"
updated_at: "2026-11-06T11:43:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123336", "first_seen_at": "2026-11-06T11:41:28+00:00"}]
exploit_sources: []
---

# JetBrains YouTrack: attachment size limit bypass via AI assistant thread conversion

Link for people: https://infrastack.ai/live/CVE-2026-123336 (this .md is for agents)

In JetBrains YouTrack before 2026.2.19728, the limit on attachment size could be bypassed when converting an AI assistant thread. The sources do not say what an attacker gains beyond exceeding the size limit.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the YouTrack version in the admin panel or on the server; the sources do not give a command.

## Fix

- Move YouTrack to `2026.2.19728` or later.

## Timeline

- 2026-11-06T11:41:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123336

## From the sources

In JetBrains YouTrack before 2026.2.19728 the attachment size limit could be bypassed via AI assistant thread conversion

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_