Description

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-17T16:17:52.430Z",
  "pubdate": "2026-08-17T16:17:52.430Z",
  "executiveSummary": "A Server-Side Request Forgery (SSRF) vulnerability exists in JetBrains IntelliJ IDEA prior to version 2026.2.1.\nThe vulnerability resides within the DevKit debug listener endpoint, allowing unauthorized request routing through the application.\nImpact includes potential unauthorized access to internal network resources, metadata services, and local infrastructure that are otherwise inaccessible from external networks.\nThe affected product is JetBrains IntelliJ IDEA, specifically deployments running vulnerable versions before 2026.2.1.\nRisk implications involve unauthorized data exposure, potential interaction with internal APIs, and service enumeration within the hosting environment.\nAttacker capabilities require the ability to interact with the target instance or trick the application into processing malicious payloads directed at the vulnerable listener endpoint.\nExploitation relies on the presence of the DevKit component exposing an inadequately restricted debug listener capable of initiating outbound connections based on unvalidated input.",
  "technicalDetails": "The vulnerability is classified as Server-Side Request Forgery (SSRF), stemming from insufficient validation and sanitization of user-supplied input handled by the DevKit debug listener endpoint within JetBrains IntelliJ IDEA.\nThe vulnerable component is the DevKit plugin subsystem, specifically its internal debug listener functionality responsible for handling incoming debugging or diagnostic connections.\nAffected versions include all instances of JetBrains IntelliJ IDEA prior to 2026.2.1.\nNetwork exposure typically involves listening interfaces associated with debugging services, which may be accessible locally or exposed depending on configuration settings.\nAuthentication and privilege requirements depend on local access vectors or network reachability to the debug listener endpoint, though unauthorized interaction is facilitated by the absence of strict access controls on the vulnerable handler.\nThe attack flow proceeds as follows: 1. The attacker crafts a malicious request targeting the DevKit debug listener endpoint within IntelliJ IDEA. 2. The listener parses the input without proper validation of destination parameters or URLs. 3. The underlying service initiates an outbound network connection to a specified target, which can be an internal resource, local network service, or external destination controlled by the attacker. 4. The application processes the response or facilitates data transit, allowing the attacker to interact with restricted internal endpoints via the vulnerable application context.\nPayload behavior involves manipulating connection parameters within the debug listener protocol or API calls to force the application to act as a proxy or traffic initiator.\nPost-exploitation impact includes internal network reconnaissance, unauthorized interaction with internal microservices, access to sensitive metadata endpoints, and potential data exfiltration mediated by the vulnerable server."
}