Description

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.7",
  "pubDate": "2026-11-06T11:17:06.010Z",
  "pubdate": "2026-11-06T11:17:06.010Z",
  "executiveSummary": "A critical Remote Code Execution (RCE) vulnerability exists in JetBrains IntelliJ IDEA versions prior to 2026.3, stemming from an insecurely configured JDBC worker RMI endpoint.\nThis vulnerability allows an unauthenticated remote attacker to execute arbitrary code within the context of the running application process.\nThe flaw resides in the Remote Method Invocation (RMI) service used for database connectivity, which fails to implement necessary authentication mechanisms.\nSuccessful exploitation grants an attacker full control over the application environment, potentially leading to unauthorized data access, lateral movement, or complete system compromise.\nThe risk is categorized as critical due to the lack of authentication requirements and the potential for direct system-level impact.\nThis issue affects users running the vulnerable versions of IntelliJ IDEA and requires immediate remediation to prevent exploitation from network-adjacent or external threats.",
  "technicalDetails": "The vulnerability is localized within the RMI (Remote Method Invocation) infrastructure utilized by the IntelliJ IDEA JDBC worker process. RMI is a Java-based mechanism that allows an object residing in one Java Virtual Machine (JVM) to invoke methods on an object residing in another JVM.\nThe root cause of this vulnerability is the exposure of an unauthenticated RMI endpoint that provides access to the JDBC worker's functionality. By default, RMI services are susceptible to object deserialization attacks and remote method execution if not properly secured with strict access controls, transport layer security, or authentication tokens.\nAn attacker can exploit this vulnerability by initiating a network connection to the exposed RMI registry or the specific RMI service port associated with the IntelliJ IDEA JDBC worker. Because the endpoint requires no authentication, the attacker can interact directly with the exported remote objects.\nThe exploitation flow typically involves an attacker sending specially crafted Java serialized objects to the RMI endpoint. When the server-side JDBC worker deserializes these objects, it may trigger unintended code execution if the classpaths contain vulnerable gadgets or if the remote methods provide functionality that allows for direct system command execution or file manipulation.\nSpecifically, the RMI mechanism may permit the remote binding or lookup of objects that expose internal administrative functions, effectively allowing the attacker to bypass standard security boundaries. By leveraging the JVM's capability to load remote classes or interact with existing loaded classes, the attacker gains the ability to execute arbitrary code with the same privileges as the IntelliJ IDEA process itself.\nThis vulnerability is particularly dangerous because it bypasses conventional perimeter defenses that might otherwise protect the IDE's UI or standard user-authenticated features. The exposure occurs at the network level, meaning any actor capable of reaching the RMI service port can initiate the attack sequence. No user interaction is required for the exploit to succeed once the connection is established.\nPost-exploitation, the attacker can achieve persistent access, perform data exfiltration, or use the compromised IDE environment as a pivot point for further attacks against the development machine or the underlying infrastructure."
}