Description

In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-09-07T17:17:26.150Z",
  "pubdate": "2026-09-07T17:17:26.150Z",
  "executiveSummary": "A critical security vulnerability exists in JetBrains Hub before version 2026.2.52442 that allows for unauthenticated privilege escalation.\nThe vulnerability manifests as an improper authentication or authorization flaw during the service registration process.\nAn unauthenticated attacker can register a rogue trusted service, effectively bypassing security controls to gain superuser privileges within the JetBrains Hub environment.\nThis vulnerability poses a severe risk as it grants an attacker complete administrative control over the application, enabling them to compromise data, modify configurations, and manage user accounts.\nExploitation does not require prior authentication, significantly lowering the barrier for entry for malicious actors.\nThe vulnerability resides within the service integration or authentication architecture of JetBrains Hub.\nImmediate patching to the specified secure version is required to eliminate this high-risk attack vector.",
  "technicalDetails": "The vulnerability lies in the service registration mechanism within JetBrains Hub, which fails to adequately validate the authenticity of requests originating from unauthorized sources.\nIn the affected versions (prior to 2026.2.52442), the application permits unauthenticated users to initiate the 'register a trusted service' workflow.\nNormally, 'trusted services' are meant to be pre-authorized or verified entities integrated with Hub to facilitate cross-service authentication and data exchange. By bypassing this verification, an attacker can trick the system into treating a malicious external entity as a legitimate, trusted component.\nThe attack flow proceeds as follows: First, the attacker identifies the API endpoint responsible for service registration. Second, the attacker crafts a malicious request to this endpoint, mimicking the payload structure expected by the system for registering a new trusted service. Third, because the system lacks sufficient authorization checks at this specific entry point, it accepts the registration request without requiring valid administrative credentials.\nOnce the rogue service is registered, it receives a trust token or similar credentials that grant it elevated permissions within the application's ecosystem. Using these granted privileges, the attacker can interact with internal APIs that are restricted to administrative or 'system-level' actors.\nBy leveraging these administrative-level permissions, the attacker can perform arbitrary actions, such as creating new administrative users, exfiltrating sensitive configuration data, or altering system settings that dictate access control policies.\nThe vulnerability is fundamentally an authorization bypass where the 'trusted' status is improperly granted to untrusted inputs. The lack of strict verification against a whitelist or a cryptographic proof of identity during the service registration handshake enables the elevation of privileges from a null (unauthenticated) state to a superuser (root-equivalent) state.\nPost-exploitation, the attacker maintains persistent access by utilizing the registered trusted service credentials. This behavior allows for long-term compromise even if temporary session tokens are invalidated, as the underlying trusted service relationship remains active until explicitly revoked by an administrator."
}