{"id":"CVE-2026-123846","kind":"vulnerability","aliases":["CVE-2026-123846"],"related":[],"title":"JetBrains IntelliJ IDEA: blind SSRF via remote JSON Schema references","description":"In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation","summary":"Before IntelliJ IDEA 2026.3, JSON Schema validation followed remote references, so a crafted schema could make the IDE send requests to hosts an attacker chooses. The attacker gets a blind server-side request forgery, meaning they can trigger requests from the developer's machine but not read the responses.","severity":"medium","cvss":4.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developer-tools","intellij-idea","jetbrains","json-schema","package"],"not_affected_if":["trusted-schemas-only","version-2026.3-or-later"],"how_to_check":"- Check the IntelliJ IDEA version under Help > About, or run `idea.sh --version` on Linux or macOS\n- Confirm whether the installed version is earlier than `2026.3`","fix":"- IntelliJ IDEA: move to `2026.3` or later","status":"open","published_at":"2026-11-06T17:17:23+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","triaged_at":"2026-11-06T17:45:40+00:00","updated_at":"2026-11-06T17:45:40+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T17:45:40Z","model":"claude-haiku-5-5","output":{"fix":"- IntelliJ IDEA: move to `2026.3` or later","reach":"local","title":"JetBrains IntelliJ IDEA: blind SSRF via remote JSON Schema references","impact":"low","summary":"Before IntelliJ IDEA 2026.3, JSON Schema validation followed remote references, so a crafted schema could make the IDE send requests to hosts an attacker chooses. The attacker gets a blind server-side request forgery, meaning they can trigger requests from the developer's machine but not read the responses.","audience":"developers","category":"package","nicknames":[],"who_cares":["intellij-idea","jetbrains","json-schema","developer-tools"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"IDE makes blind server-side requests to attacker-chosen hosts","analyst_note":"","how_to_check":"- Check the IntelliJ IDEA version under Help > About, or run `idea.sh --version` on Linux or macOS\n- Confirm whether the installed version is earlier than `2026.3`","plain_action":"","needs_analyst":false,"not_affected_if":["version-2026.3-or-later","trusted-schemas-only"],"who_is_affected":"Developers who open JSON Schema files from untrusted sources in IntelliJ IDEA versions before 2026.3 may have the IDE make outbound requests. Teams that only open their own schemas and keep the IDE updated can deprioritise it. The sources do not say whether non-default settings change exposure.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.0007,"input_tokens":4178,"output_tokens":564,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123846':13A,16A '-2026':12A,15A '2026.3':31B,83C 'attack':51B,54B 'blind':4A,57B,84C 'choos':52B 'could':42B 'craft':40B 'cve':11A,14A 'develop':18B,70B 'developer-tool':17B 'follow':35B 'forgeri':62B 'get':55B 'host':49B 'ide':45B 'idea':3A,22B,30B,81C 'intellij':2A,21B,29B,80C 'intellij-idea':20B 'jetbrain':1A,23B,79C 'json':8A,25B,32B,92C 'json-schema':24B 'machin':72B 'make':43B 'mean':63B 'packag':27B 'possibl':87C 'read':75B 'refer':10A,37B,90C 'remot':7A,36B,89C 'request':47B,61B,67B 'respons':77B 'schema':9A,26B,33B,41B,93C 'send':46B 'server':59B 'server-sid':58B 'side':60B 'ssrf':5A,85C 'tool':19B 'trigger':66B 'valid':34B,94C 'via':6A,88C","nicknames":[],"mitigations":[],"who_affected":"Developers who open JSON Schema files from untrusted sources in IntelliJ IDEA versions before 2026.3 may have the IDE make outbound requests. Teams that only open their own schemas and keep the IDE updated can deprioritise it. The sources do not say whether non-default settings change exposure.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["developertools","intellijidea","jetbrains","jsonschema","medium","package"],"campaign_type":null,"search_a":"'-123846':13A,16A '-2026':12A,15A 'blind':4A 'cve':11A,14A 'idea':3A 'intellij':2A 'jetbrain':1A 'json':8A 'refer':10A 'remot':7A 'schema':9A 'ssrf':5A 'via':6A","search_b":"'2026.3':31B 'attack':51B,54B 'blind':57B 'choos':52B 'could':42B 'craft':40B 'develop':18B,70B 'developer-tool':17B 'follow':35B 'forgeri':62B 'get':55B 'host':49B 'ide':45B 'idea':22B,30B 'intellij':21B,29B 'intellij-idea':20B 'jetbrain':23B 'json':25B,32B 'json-schema':24B 'machin':72B 'make':43B 'mean':63B 'packag':27B 'read':75B 'refer':37B 'remot':36B 'request':47B,61B,67B 'respons':77B 'schema':26B,33B,41B 'send':46B 'server':59B 'server-sid':58B 'side':60B 'tool':19B 'trigger':66B 'valid':34B","search_c":"'2026.3':83C 'blind':84C 'idea':81C 'intellij':80C 'jetbrain':79C 'json':92C 'possibl':87C 'refer':90C 'remot':89C 'schema':93C 'ssrf':85C 'valid':94C 'via':88C","first_public_at":"2026-11-06T17:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123846","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123846","severity":null,"published_at":"2026-11-06T17:17:23+00:00","modified_at":"2026-11-06T17:17:23+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","fetched_at":"2026-11-06T17:43:13+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}