{"id":"CVE-2026-123843","kind":"vulnerability","aliases":["CVE-2026-123843"],"related":[],"title":"JetBrains IntelliJ IDEA: untrusted projects can change GPG agent configuration","description":"In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration","summary":"Before IntelliJ IDEA 2026.3, opening an untrusted project could make the IDE change the GPG agent configuration on the developer's machine. The sources do not say what an attacker gains beyond altering that configuration.","severity":"low","cvss":3.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developer-workstation","gpg","intellij-idea","jetbrains","other"],"not_affected_if":["only-trusted-projects","version-2026.3-or-later"],"how_to_check":"- Check the IntelliJ IDEA version under Help > About; the affected versions are those before `2026.3`.\n- Open the project only in trusted mode if the source is unknown; the sources do not name a specific setting to inspect.","fix":"- Move IntelliJ IDEA to `2026.3` or later.","status":"open","published_at":"2026-11-06T17:17:22+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","triaged_at":"2026-11-06T17:45:46+00:00","updated_at":"2026-11-06T17:45:46+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-06T17:45:46Z","model":"claude-haiku-5-5","output":{"fix":"- Move IntelliJ IDEA to `2026.3` or later.","reach":"local","title":"JetBrains IntelliJ IDEA: untrusted projects can change GPG agent configuration","impact":"low","summary":"Before IntelliJ IDEA 2026.3, opening an untrusted project could make the IDE change the GPG agent configuration on the developer's machine. The sources do not say what an attacker gains beyond altering that configuration.","audience":"developers","category":"other","nicknames":[],"who_cares":["intellij-idea","jetbrains","gpg","developer-workstation"],"confidence":0.5,"fix_status":"available","needs_auth":"no","worst_case":"GPG agent configuration on the developer machine gets changed","analyst_note":"","how_to_check":"- Check the IntelliJ IDEA version under Help > About; the affected versions are those before `2026.3`.\n- Open the project only in trusted mode if the source is unknown; the sources do not name a specific setting to inspect.","plain_action":"","needs_analyst":false,"not_affected_if":["version-2026.3-or-later","only-trusted-projects"],"who_is_affected":"Developers who open untrusted projects in IntelliJ IDEA versions before 2026.3 on a machine with GPG configured. The sources do not describe further conditions. Teams using only trusted repositories or current IDE versions can skip it.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000677,"input_tokens":4175,"output_tokens":519,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-123843':13A,16A '-2026':12A,15A '2026.3':28B,65C 'agent':9A,40B,73C 'alter':57B 'attack':54B 'beyond':56B 'chang':7A,37B,70C 'configur':10A,41B,59B,74C 'could':33B,68C 'cve':11A,14A 'develop':18B,44B 'developer-workst':17B 'gain':55B 'gpg':8A,20B,39B,72C 'ide':36B 'idea':3A,23B,27B,63C 'intellij':2A,22B,26B,62C 'intellij-idea':21B 'jetbrain':1A,24B,61C 'machin':46B 'make':34B 'open':29B 'project':5A,32B,67C 'say':51B 'sourc':48B 'trigger':69C 'untrust':4A,31B,66C 'workstat':19B","nicknames":[],"mitigations":[],"who_affected":"Developers who open untrusted projects in IntelliJ IDEA versions before 2026.3 on a machine with GPG configured. The sources do not describe further conditions. Teams using only trusted repositories or current IDE versions can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["developerworkstation","gpg","intellijidea","jetbrains","low","other"],"campaign_type":null,"search_a":"'-123843':13A,16A '-2026':12A,15A 'agent':9A 'chang':7A 'configur':10A 'cve':11A,14A 'gpg':8A 'idea':3A 'intellij':2A 'jetbrain':1A 'project':5A 'untrust':4A","search_b":"'2026.3':28B 'agent':40B 'alter':57B 'attack':54B 'beyond':56B 'chang':37B 'configur':41B,59B 'could':33B 'develop':18B,44B 'developer-workst':17B 'gain':55B 'gpg':20B,39B 'ide':36B 'idea':23B,27B 'intellij':22B,26B 'intellij-idea':21B 'jetbrain':24B 'machin':46B 'make':34B 'open':29B 'project':32B 'say':51B 'sourc':48B 'untrust':31B 'workstat':19B","search_c":"'2026.3':65C 'agent':73C 'chang':70C 'configur':74C 'could':68C 'gpg':72C 'idea':63C 'intellij':62C 'jetbrain':61C 'project':67C 'trigger':69C 'untrust':66C","first_public_at":"2026-11-06T17:17:22+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123843","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123843","severity":null,"published_at":"2026-11-06T17:17:22+00:00","modified_at":"2026-11-06T17:17:22+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","fetched_at":"2026-11-06T17:43:13+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}