---
id: "CVE-2026-123839"
page: "https://infrastack.ai/live/CVE-2026-123839"
kind: "vulnerability"
aliases: ["CVE-2026-123839"]
title: "JetBrains IntelliJ IDEA: arbitrary URLs open without confirmation via port forwarding"
severity: "medium"
cvss: 4.7
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["intellij-idea", "jetbrains", "other", "remote-development"]
not_affected_if: ["remote-development-unused"]
published_at: "2026-11-06T17:17:22+00:00"
first_seen_at: "2026-11-06T17:43:13+00:00"
updated_at: "2026-11-06T17:45:33+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123839", "first_seen_at": "2026-11-06T17:43:13+00:00"}]
exploit_sources: []
---

# JetBrains IntelliJ IDEA: arbitrary URLs open without confirmation via port forwarding

Link for people: https://infrastack.ai/live/CVE-2026-123839 (this .md is for agents)

In JetBrains IntelliJ IDEA before 2026.3, the Remote Development port forwarding model could open arbitrary URLs without asking the user to confirm. An attacker who can influence a forwarded port could get a victim's IDE to open a link they chose.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed IntelliJ IDEA version under Help > About and compare it with `2026.3`.
- Look at whether Remote Development port forwarding is in use.

## Fix

- IntelliJ IDEA: move to `2026.3` or later (the sources give this as the first fixed version).

## Timeline

- 2026-11-06T17:43:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123839

## From the sources

In JetBrains IntelliJ IDEA before 2026.3 opening arbitrary URLs without confirmation was possible via the Remote Development port forwarding model

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_