---
id: "CVE-2026-123843"
page: "https://infrastack.ai/live/CVE-2026-123843"
kind: "vulnerability"
aliases: ["CVE-2026-123843"]
title: "JetBrains IntelliJ IDEA: untrusted projects can change GPG agent configuration"
severity: "low"
cvss: 3.3
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["developer-workstation", "gpg", "intellij-idea", "jetbrains", "other"]
not_affected_if: ["only-trusted-projects", "version-2026.3-or-later"]
published_at: "2026-11-06T17:17:22+00:00"
first_seen_at: "2026-11-06T17:43:13+00:00"
updated_at: "2026-11-06T17:45:46+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123843", "first_seen_at": "2026-11-06T17:43:13+00:00"}]
exploit_sources: []
---

# JetBrains IntelliJ IDEA: untrusted projects can change GPG agent configuration

Link for people: https://infrastack.ai/live/CVE-2026-123843 (this .md is for agents)

Before IntelliJ IDEA 2026.3, opening an untrusted project could make the IDE change the GPG agent configuration on the developer's machine. The sources do not say what an attacker gains beyond altering that configuration.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the IntelliJ IDEA version under Help > About; the affected versions are those before `2026.3`.
- Open the project only in trusted mode if the source is unknown; the sources do not name a specific setting to inspect.

## Fix

- Move IntelliJ IDEA to `2026.3` or later.

## Timeline

- 2026-11-06T17:43:13+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123843

## From the sources

In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_