{"id":"CVE-2026-123833","kind":"vulnerability","aliases":["CVE-2026-123833"],"related":[],"title":"JetBrains IntelliJ IDEA: untrusted projects could open database connections","description":"In JetBrains IntelliJ IDEA before 2026.3 database connections could be established in untrusted projects","summary":"In IntelliJ IDEA before 2026.3, database connections could be made from projects the user had not marked as trusted. An attacker who gets a malicious project in front of a developer could use the IDE to reach a database.","severity":"low","cvss":3.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["database-tools","intellij-idea","jetbrains","other"],"not_affected_if":["trusted-projects-only","version-2026.3-or-later"],"how_to_check":"- Check the IntelliJ IDEA version under Help > About, or run `idea --version` if the launcher is on the PATH.\n- Confirm whether the version is earlier than `2026.3`.","fix":"- IntelliJ IDEA: move to `2026.3` or later, per the affected range in the NVD entry.","status":"open","published_at":"2026-11-06T17:17:21+00:00","first_seen_at":"2026-11-06T17:43:12+00:00","triaged_at":"2026-11-06T17:45:44+00:00","updated_at":"2026-11-06T17:45:44+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-06T17:45:44Z","model":"claude-haiku-5-5","output":{"fix":"- IntelliJ IDEA: move to `2026.3` or later, per the affected range in the NVD entry.","reach":"local","title":"JetBrains IntelliJ IDEA: untrusted projects could open database connections","impact":"low","summary":"In IntelliJ IDEA before 2026.3, database connections could be made from projects the user had not marked as trusted. An attacker who gets a malicious project in front of a developer could use the IDE to reach a database.","audience":"developers","category":"other","nicknames":[],"who_cares":["intellij-idea","jetbrains","database-tools"],"confidence":0.5,"fix_status":"available","needs_auth":"unknown","worst_case":"database connections open from an untrusted project's configuration","analyst_note":"","how_to_check":"- Check the IntelliJ IDEA version under Help > About, or run `idea --version` if the launcher is on the PATH.\n- Confirm whether the version is earlier than `2026.3`.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2026.3-or-later","trusted-projects-only"],"who_is_affected":"Developers who open projects from untrusted sources in IntelliJ IDEA before 2026.3 and use database tools in those projects. The sources do not describe further conditions, so it is unknown whether a default configuration is exposed.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000666,"input_tokens":4159,"output_tokens":500,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-123833':12A,15A '-2026':11A,14A '2026.3':27B,67C 'attack':43B 'connect':9A,29B,69C 'could':6A,30B,54B,70C 'cve':10A,13A 'databas':8A,17B,28B,61B,68C 'database-tool':16B 'develop':53B 'establish':72C 'front':50B 'get':45B 'ide':57B 'idea':3A,21B,25B,65C 'intellij':2A,20B,24B,64C 'intellij-idea':19B 'jetbrain':1A,22B,63C 'made':32B 'malici':47B 'mark':39B 'open':7A 'project':5A,34B,48B,75C 'reach':59B 'tool':18B 'trust':41B 'untrust':4A,74C 'use':55B 'user':36B","nicknames":[],"mitigations":[],"who_affected":"Developers who open projects from untrusted sources in IntelliJ IDEA before 2026.3 and use database tools in those projects. The sources do not describe further conditions, so it is unknown whether a default configuration is exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["databasetools","intellijidea","jetbrains","low","other"],"campaign_type":null,"search_a":"'-123833':12A,15A '-2026':11A,14A 'connect':9A 'could':6A 'cve':10A,13A 'databas':8A 'idea':3A 'intellij':2A 'jetbrain':1A 'open':7A 'project':5A 'untrust':4A","search_b":"'2026.3':27B 'attack':43B 'connect':29B 'could':30B,54B 'databas':17B,28B,61B 'database-tool':16B 'develop':53B 'front':50B 'get':45B 'ide':57B 'idea':21B,25B 'intellij':20B,24B 'intellij-idea':19B 'jetbrain':22B 'made':32B 'malici':47B 'mark':39B 'project':34B,48B 'reach':59B 'tool':18B 'trust':41B 'use':55B 'user':36B","search_c":"'2026.3':67C 'connect':69C 'could':70C 'databas':68C 'establish':72C 'idea':65C 'intellij':64C 'jetbrain':63C 'project':75C 'untrust':74C","first_public_at":"2026-11-06T17:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123833","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123833","severity":null,"published_at":"2026-11-06T17:17:21+00:00","modified_at":"2026-11-06T17:17:21+00:00","first_seen_at":"2026-11-06T17:43:12+00:00","fetched_at":"2026-11-06T17:43:12+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}