{"id":"CVE-2026-123848","kind":"vulnerability","aliases":["CVE-2026-123848"],"related":[],"title":"JetBrains IntelliJ IDEA: missing host name check on server TLS certificates","description":"In JetBrains IntelliJ IDEA before 2026.3 host name verification was missing for server TLS certificates","summary":"IntelliJ IDEA before 2026.3 does not verify that a server's TLS certificate matches the host name it connects to. An attacker who can intercept the network path could impersonate the server and read or alter the traffic.","severity":"high","cvss":7.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["developer-tools","intellij-idea","java","jetbrains","other"],"not_affected_if":["version-2026.3-or-later"],"how_to_check":"- Open Help > About in IntelliJ IDEA and compare the build with `2026.3`","fix":"- IntelliJ IDEA: move to `2026.3` or later (per the NVD description: before 2026.3 is affected)","status":"open","published_at":"2026-11-06T17:17:23+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","triaged_at":"2026-11-06T17:45:07+00:00","updated_at":"2026-11-06T17:45:07+00:00","category":"other","confidence":0.6,"triage":{"at":"2026-11-06T17:45:07Z","model":"claude-haiku-5-5","output":{"fix":"- IntelliJ IDEA: move to `2026.3` or later (per the NVD description: before 2026.3 is affected)","reach":"network","title":"JetBrains IntelliJ IDEA: missing host name check on server TLS certificates","impact":"medium","summary":"IntelliJ IDEA before 2026.3 does not verify that a server's TLS certificate matches the host name it connects to. An attacker who can intercept the network path could impersonate the server and read or alter the traffic.","audience":"developers","category":"other","nicknames":[],"who_cares":["intellij-idea","jetbrains","java","developer-tools"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"attacker impersonates a server and reads or alters traffic","analyst_note":"Find the JetBrains advisory to confirm which connections (plugin, update, or project server) are affected and whether the attack needs a man-in-the-middle position.","how_to_check":"- Open Help > About in IntelliJ IDEA and compare the build with `2026.3`\n- unknown for other checks; the sources do not say which connections or settings are affected","plain_action":"","needs_analyst":true,"not_affected_if":["version-2026.3-or-later"],"who_is_affected":"Developers running IntelliJ IDEA builds older than 2026.3 are exposed when they connect to servers over TLS. The sources do not say which features or connections are affected, so the exposure is likely limited to those on an untrusted network path. Teams that already run 2026.3 or later can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000703,"input_tokens":4163,"output_tokens":574,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-123848':14A,17A '-2026':13A,16A '2026.3':29B,69C 'alter':61B 'attack':47B 'certif':11A,38B,78C 'check':7A 'connect':44B 'could':54B 'cve':12A,15A 'develop':19B 'developer-tool':18B 'host':5A,41B,70C 'idea':3A,23B,27B,67C 'imperson':55B 'intellij':2A,22B,26B,66C 'intellij-idea':21B 'intercept':50B 'java':24B 'jetbrain':1A,25B,65C 'match':39B 'miss':4A,74C 'name':6A,42B,71C 'network':52B 'path':53B 'read':59B 'server':9A,35B,57B,76C 'tls':10A,37B,77C 'tool':20B 'traffic':63B 'verif':72C 'verifi':32B","nicknames":[],"mitigations":[],"who_affected":"Developers running IntelliJ IDEA builds older than 2026.3 are exposed when they connect to servers over TLS. The sources do not say which features or connections are affected, so the exposure is likely limited to those on an untrusted network path. Teams that already run 2026.3 or later can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["developertools","high","intellijidea","java","jetbrains","other"],"campaign_type":null,"search_a":"'-123848':14A,17A '-2026':13A,16A 'certif':11A 'check':7A 'cve':12A,15A 'host':5A 'idea':3A 'intellij':2A 'jetbrain':1A 'miss':4A 'name':6A 'server':9A 'tls':10A","search_b":"'2026.3':29B 'alter':61B 'attack':47B 'certif':38B 'connect':44B 'could':54B 'develop':19B 'developer-tool':18B 'host':41B 'idea':23B,27B 'imperson':55B 'intellij':22B,26B 'intellij-idea':21B 'intercept':50B 'java':24B 'jetbrain':25B 'match':39B 'name':42B 'network':52B 'path':53B 'read':59B 'server':35B,57B 'tls':37B 'tool':20B 'traffic':63B 'verifi':32B","search_c":"'2026.3':69C 'certif':78C 'host':70C 'idea':67C 'intellij':66C 'jetbrain':65C 'miss':74C 'name':71C 'server':76C 'tls':77C 'verif':72C","first_public_at":"2026-11-06T17:17:23+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123848","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123848","severity":null,"published_at":"2026-11-06T17:17:23+00:00","modified_at":"2026-11-06T17:17:23+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","fetched_at":"2026-11-06T17:43:13+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}