CVE-2026-123846 · Package
NO FIX YET · SEE WHAT TO DO
Before IntelliJ IDEA 2026.3, JSON Schema validation followed remote references, so a crafted schema could make the IDE send requests to hosts an attacker chooses. The attacker gets a blind server-side request forgery, meaning they can trigger requests from the developer's machine but not read the responses.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Developers who open JSON Schema files from untrusted sources in IntelliJ IDEA versions before 2026.3 may have the IDE make outbound requests. Teams that only open their own schemas and keep the IDE updated can deprioritise it. The sources do not say whether non-default settings change exposure.
Not affected if trusted-schemas-only, version-2026.3-or-later
Who cares developer-tools, intellij-idea, jetbrains, json-schema
idea.sh --version on Linux or macOS2026.32026.3 or laterIn JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.