Description

In JetBrains IntelliJ IDEA before 2026.3 improper checks allowed server certificates to be added to the trust store during headless runs

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-11-06T11:17:09.600Z",
  "pubdate": "2026-11-06T11:17:09.600Z",
  "executiveSummary": "This vulnerability involves an improper validation logic flaw within JetBrains IntelliJ IDEA versions prior to 2026.3, specifically affecting headless runtime environments.\nThe vulnerability allows for the unauthorized addition of arbitrary server certificates into the application's trust store. This occurs due to inadequate security checks performed during headless execution contexts, where automated processes or CI/CD pipelines typically operate.\nThe primary risk implication is the potential for Man-in-the-Middle (MitM) attacks. An attacker capable of intercepting network traffic can leverage this flaw to force the IDE or associated headless tools to trust malicious certificates.\nBy successfully injecting a rogue certificate, an adversary could intercept, decrypt, and manipulate encrypted communications between the IDE and remote services, such as version control systems, plugin repositories, or build servers.\nSuccessful exploitation requires the attacker to position themselves in the network path of the headless process. Because this occurs in a trust store management function, the impact results in a permanent compromise of the certificate validation chain for that instance until the trust store is manually cleared or reset.\nThis vulnerability highlights a failure in enforcing strict certificate pinning or verification policies when the IDE is operating outside of a standard GUI-based user session.",
  "technicalDetails": "The root cause of this vulnerability lies in a logic error during the certificate validation and trust store management routines within the IntelliJ IDEA core. Specifically, when the platform is initialized in 'headless' mode—often used for batch processing, automated build tasks, or server-side integration—the security checks that typically govern the interactive approval process for new SSL/TLS certificates are bypassed or insufficiently implemented.\nIn a standard GUI environment, IntelliJ IDEA prompts the user to verify a server's identity if the certificate is unknown or self-signed. However, the internal mechanisms governing headless runs failed to enforce these verification barriers. Consequently, if a headless process encounters a TLS handshake involving an untrusted or malicious server certificate, the application improperly permits the automatic addition of this certificate to the internal trust store.\nThe attack flow begins when an attacker performs a network-level intercept on the connection initiated by the IntelliJ headless instance. By presenting a crafted or rogue server certificate during the TLS handshake, the attacker induces the headless process to trigger its certificate ingestion logic. Because the integrity checks are absent or flawed in the headless execution path, the IDE implicitly trusts the provided certificate and commits it to its local trust store file.\nOnce the malicious certificate is embedded in the trust store, subsequent connections made by the headless instance are no longer subject to standard PKI validation against legitimate Root Certificate Authorities. This facilitates a persistent state of interception, allowing an attacker to decrypt sensitive traffic, inject malicious payloads into fetched dependencies, or exfiltrate credentials used by the automated system.\nThe vulnerability affects all versions of IntelliJ IDEA prior to 2026.3. The lack of authentication for certificate ingestion in headless mode means that any entity able to force a TLS handshake with the targeted service can exploit this, provided the headless instance is configured to use the IDE's trust store. This issue bypasses the protection usually provided by standard certificate validation policies, effectively lowering the bar for credential theft and arbitrary code execution via compromised dependencies or malicious server responses.\nThe post-exploitation phase involves the adversary masquerading as a legitimate service, such as a Maven repository or a Git server, thereby gaining full visibility into the data streams processed by the headless IntelliJ instance, leading to significant downstream security degradation in the development environment."
}