Description

In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.2",
  "pubDate": "2026-08-17T16:17:52.880Z",
  "pubdate": "2026-08-17T16:17:52.880Z",
  "executiveSummary": "A sensitive information disclosure vulnerability exists in JetBrains IntelliJ IDEA before 2026.1.5, specifically involving the unintended persistence of sensitive authentication material within application log files.\nThe vulnerability arises due to the insecure handling of git credentials during version control operations, causing plaintext authentication secrets to be written directly to the IDE log.\nThis exposes administrative and developer credentials to any user, process, or local monitoring tool with read access to the local filesystem and log directory.\nThe impact includes unauthorized access to remote code repositories, source code theft, and potential supply chain compromise if threat actors harvest these exposed secrets.\nExploitation requires local access to the victim's workstation or environment where the IDE log files are stored, necessitating no prior authentication to the target system if local file permissions are misconfigured or if logs are improperly shared.",
  "technicalDetails": "The root cause of the vulnerability lies within the internal logging mechanisms of the affected Git integration component in JetBrains IntelliJ IDEA.\nDuring specific Git operations, the application improperly sanitizes command outputs or internal debugging traces, resulting in the serialization of plaintext git credentials directly to the IDE's diagnostic log files.\nThe affected component is the version control subsystem responsible for executing Git commands and handling repository authentication flows.\nAll versions of JetBrains IntelliJ IDEA prior to 2026.1.5 are considered vulnerable to this behavior.\nThe attack flow proceeds as follows: 1) A developer initiates a Git operation requiring authentication, such as a clone, fetch, pull, or push, within IntelliJ IDEA. 2) The IDE invokes the underlying Git executable or internal client, passing sensitive authentication parameters including tokens, usernames, or passwords. 3) The application's diagnostic logging subsystem captures the execution details, omitting adequate redaction filters for authentication headers or URL-embedded credentials. 4) The plaintext credentials are written to the local log file stored within the IDE's configuration or cache directories. 5) An adversary or unauthorized local process reads the log file to extract the harvested credentials.\nPost-exploitation impact involves the reuse of the harvested git credentials to access private repositories, execute unauthorized code commits, manipulate source code, or pivot to other integrated development infrastructure."
}