Description

In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-08-17T16:17:53.227Z",
  "pubdate": "2026-08-17T16:17:53.227Z",
  "executiveSummary": "A critical code execution vulnerability exists in JetBrains PyCharm before 2026.2.1 involving unauthenticated Jupyter MCP tools.\nThe vulnerability allows unauthenticated remote or local attackers to execute arbitrary code within the context of the affected application.\nThe flaw specifically resides in the handling and exposure of Jupyter Model Context Protocol (MCP) tools within the development environment.\nSuccessful exploitation compromises the confidentiality, integrity, and availability of the host system running PyCharm, posing severe risk to developer workstations and integrated environments.\nAttackers do not require prior authentication or elevated privileges to interact with the vulnerable MCP tools, lowering the barrier to successful exploitation.\nRemediation requires updating PyCharm to version 2026.2.1 or later where the exposure and trust boundaries of Jupyter MCP tools are properly secured.",
  "technicalDetails": "The vulnerability stems from improper access control and insufficient authentication enforcement within the Jupyter MCP tools component of JetBrains PyCharm before 2026.2.1.\nModel Context Protocol (MCP) endpoints and associated tools exposed by the application fail to validate client authentication, permitting unauthenticated entities to invoke privileged operational handlers.\nThe vulnerable component is responsible for bridging Jupyter functionalities via MCP, exposing internal interfaces that process incoming tool execution requests without cryptographic validation or session verification.\nThe attack flow proceeds as follows: First, an unauthorized actor discovers or targets the exposed Jupyter MCP tool interface provided by the running PyCharm instance. Second, the actor crafts a malicious request payload designed to invoke code execution capabilities through the exposed MCP tools. Third, because the application lacks authentication checks on these specific endpoints, the request is accepted and processed by the backend handler. Finally, the payload is executed by the underlying Python runtime or environment managed by PyCharm, resulting in arbitrary code execution on the host operating system.\nNetwork exposure depends on how the MCP server binds its listeners, potentially allowing local process interaction or broader network accessibility depending on configuration.\nPrivilege and authentication requirements are entirely absent, as the vulnerability explicitly involves unauthenticated access paths.\nThe post-exploitation impact includes full system compromise, unauthorized data access, manipulation of source code repositories, and potential lateral movement within the developer network."
}