{"id":"CVE-2026-123856","kind":"vulnerability","aliases":["CVE-2026-123856"],"related":[],"title":"JetBrains Toolbox App leaks NTLM hashes via SVG icons from remote servers","description":"In JetBrains Toolbox App before 3.6.1 nTLM hash disclosure was possible via SVG tool icons from a Remote Development server","summary":"JetBrains Toolbox App before 3.6.1 loaded SVG tool icons from a Remote Development server in a way that disclosed NTLM hashes. An attacker controlling that server could collect a user's NTLM hash, which can be used in password-cracking or relay attacks.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jetbrains","package","remote-development","toolbox-app","windows"],"not_affected_if":["no-remote-development","toolbox-app-3.6.1-or-later"],"how_to_check":"- Check the installed Toolbox App version in its About dialog; versions before `3.6.1` are affected.\n- Check whether Remote Development connections to untrusted or unmanaged servers are in use.","fix":"- JetBrains Toolbox App: move to `3.6.1` or later.","status":"open","published_at":"2026-11-06T17:17:24+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","triaged_at":"2026-11-06T17:45:16+00:00","updated_at":"2026-11-06T17:45:16+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T17:45:16Z","model":"claude-haiku-5-5","output":{"fix":"- JetBrains Toolbox App: move to `3.6.1` or later.","reach":"network","title":"JetBrains Toolbox App leaks NTLM hashes via SVG icons from remote servers","impact":"medium","summary":"JetBrains Toolbox App before 3.6.1 loaded SVG tool icons from a Remote Development server in a way that disclosed NTLM hashes. An attacker controlling that server could collect a user's NTLM hash, which can be used in password-cracking or relay attacks.","audience":"developers","category":"package","nicknames":[],"who_cares":["jetbrains","toolbox-app","remote-development","windows"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"NTLM password hash of the user is disclosed to a remote server","analyst_note":"","how_to_check":"- Check the installed Toolbox App version in its About dialog; versions before `3.6.1` are affected.\n- Check whether Remote Development connections to untrusted or unmanaged servers are in use.","plain_action":"","needs_analyst":false,"not_affected_if":["toolbox-app-3.6.1-or-later","no-remote-development"],"who_is_affected":"Developers who use JetBrains Toolbox App with Remote Development connections, particularly to servers they do not fully control. The sources do not state further configuration requirements.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000674,"input_tokens":4186,"output_tokens":511,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-123856':15A,18A '-2026':14A,17A '3.6.1':32B,77C 'app':3A,26B,30B,75C 'attack':50B,71B 'collect':55B 'control':51B 'could':54B 'crack':68B 'cve':13A,16A 'develop':23B,40B,90C 'disclos':46B 'disclosur':80C 'hash':6A,48B,60B,79C 'icon':9A,36B,86C 'jetbrain':1A,19B,28B,73C 'leak':4A 'load':33B 'ntlm':5A,47B,59B,78C 'packag':20B 'password':67B 'password-crack':66B 'possibl':82C 'relay':70B 'remot':11A,22B,39B,89C 'remote-develop':21B 'server':12A,41B,53B,91C 'svg':8A,34B,84C 'tool':35B,85C 'toolbox':2A,25B,29B,74C 'toolbox-app':24B 'use':64B 'user':57B 'via':7A,83C 'way':44B 'window':27B","nicknames":[],"mitigations":[],"who_affected":"Developers who use JetBrains Toolbox App with Remote Development connections, particularly to servers they do not fully control. The sources do not state further configuration requirements.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["jetbrains","medium","package","remotedevelopment","toolboxapp","windows"],"campaign_type":null,"search_a":"'-123856':15A,18A '-2026':14A,17A 'app':3A 'cve':13A,16A 'hash':6A 'icon':9A 'jetbrain':1A 'leak':4A 'ntlm':5A 'remot':11A 'server':12A 'svg':8A 'toolbox':2A 'via':7A","search_b":"'3.6.1':32B 'app':26B,30B 'attack':50B,71B 'collect':55B 'control':51B 'could':54B 'crack':68B 'develop':23B,40B 'disclos':46B 'hash':48B,60B 'icon':36B 'jetbrain':19B,28B 'load':33B 'ntlm':47B,59B 'packag':20B 'password':67B 'password-crack':66B 'relay':70B 'remot':22B,39B 'remote-develop':21B 'server':41B,53B 'svg':34B 'tool':35B 'toolbox':25B,29B 'toolbox-app':24B 'use':64B 'user':57B 'way':44B 'window':27B","search_c":"'3.6.1':77C 'app':75C 'develop':90C 'disclosur':80C 'hash':79C 'icon':86C 'jetbrain':73C 'ntlm':78C 'possibl':82C 'remot':89C 'server':91C 'svg':84C 'tool':85C 'toolbox':74C 'via':83C","first_public_at":"2026-11-06T17:17:24+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"cve@jetbrains.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123856","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123856","severity":null,"published_at":"2026-11-06T17:17:24+00:00","modified_at":"2026-11-06T17:17:24+00:00","first_seen_at":"2026-11-06T17:43:13+00:00","fetched_at":"2026-11-06T17:43:13+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}