Description

In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 unauthenticated connection to an arbitrary host via run configurations was possible

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-11-06T11:17:09.727Z",
  "pubdate": "2026-11-06T11:17:09.727Z",
  "executiveSummary": "A vulnerability exists in JetBrains IntelliJ IDEA allowing unauthenticated remote connections to arbitrary hosts through run configuration parameters.\nThe flaw stems from insufficient validation or sanitization of input within the run configuration subsystem, enabling an attacker to force the application to initiate network connections to unintended destinations.\nThis vulnerability affects versions of IntelliJ IDEA prior to 2026.3, including 2026.2.4.\nThe risk implication is significant as it potentially facilitates Server-Side Request Forgery (SSRF) or similar unauthorized networking operations, which could be leveraged to probe internal network infrastructure or exfiltrate configuration metadata.\nExploitation does not require prior authentication, meaning an attacker can leverage this primitive remotely if the IDE environment or its configuration files are exposed to malicious actors.\nSuccessful exploitation allows for arbitrary network interaction originating from the host system where the IDE is executing, bypassing local network security controls.",
  "technicalDetails": "The vulnerability resides within the JetBrains IntelliJ IDEA run configuration management component. The root cause is the improper handling of user-defined parameters within run configurations, which fails to enforce strict allow-lists or validation checks for network host targets.\nWhen a user or automated process defines a run configuration, the IDE typically prepares to execute the target process or task. The vulnerability allows an attacker to inject or manipulate the destination host fields in a way that the IDE's internal networking subsystems honor these connections without validating the legitimacy of the target destination.\nAttack Flow: An attacker, having access to an environment where they can manipulate or inject an IntelliJ IDEA run configuration (such as via a shared project file like .idea/workspace.xml), specifies a malicious host or internal IP address in the configuration parameters. When the IDE subsequently parses or attempts to initialize the run configuration, it executes a network request to the attacker-specified host. Because this process occurs at the IDE level, the request inherits the network privileges and context of the user running the IDE.\nNetwork Exposure: This issue is critical because it allows a low-privilege actor to leverage the IDE as a proxy or agent to interact with restricted network segments. If the IDE is running on a server or a developer workstation with access to private networks, the attacker can conduct internal reconnaissance, interact with local services that expect traffic only from localhost, or potentially bypass firewall rules that restrict direct external access.\nThe exploitation does not require the attacker to authenticate to the IDE itself; it relies on the IDE's automatic processing of project configuration files. If an attacker can force a victim to open a maliciously crafted project or overwrite an existing configuration, the IDE will proceed to establish the unauthorized connection automatically.\nThe impact includes the ability to perform blind or non-blind SSRF attacks, potentially leading to information disclosure regarding the local machine's environment, local service fingerprinting, or the triggering of actions in internal web-based services that are susceptible to CSRF-like patterns initiated by the trusted IDE process.\nVersions affected include all iterations prior to 2026.3, including version 2026.2.4. The vulnerability reflects a lack of sandboxing or network policy enforcement for run-time configurations within the IDE core."
}