Description

In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.5",
  "pubDate": "2026-09-07T17:17:27.517Z",
  "pubdate": "2026-09-07T17:17:27.517Z",
  "executiveSummary": "This vulnerability involves a critical flaw in JetBrains YouTrack concerning the improper management of shared token caches.\nThe issue manifests as a cross-tenant information disclosure vulnerability, specifically targeting GitHub App installation tokens.\nAffected systems include all YouTrack versions prior to 2026.2.18634.\nThe vulnerability allows an unauthorized attacker to access and exfiltrate sensitive authentication tokens belonging to other tenants within a multi-tenant environment.\nBy successfully exploiting this flaw, an attacker gains the ability to impersonate a GitHub App installation, potentially granting them unauthorized access to private repositories, codebases, and CI/CD pipelines managed by the compromised tenant.\nThe risk implication is severe, as it facilitates unauthorized lateral movement and data exfiltration across isolated tenant boundaries without requiring prior authentication into the target tenant's environment.\nExploitation is feasible for any user with access to the YouTrack platform, as the shared caching mechanism fails to implement sufficient logical partitioning or cryptographic isolation between distinct tenants.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of the application-level caching layer within the YouTrack GitHub integration module. Specifically, the system utilizes a centralized or insufficiently scoped cache for GitHub App installation tokens, which does not adequately account for multi-tenant isolation.\nIn a multi-tenant YouTrack deployment, GitHub App installation tokens are intended to be cryptographically bound to specific installation IDs and tenant contexts. However, the shared cache mechanism fails to utilize the tenant identifier as a primary key or namespace during the caching process. Consequently, tokens retrieved for a specific tenant are stored in a memory space accessible to other tenants sharing the same application process.\nThe attack flow begins when a victim tenant performs an operation that triggers the YouTrack GitHub integration to fetch or refresh an installation token. Because the cache key is not sufficiently granular, the token is cached globally. An attacker, acting as a user within a different tenant on the same instance, can then trigger a request or leverage an existing functionality that queries the shared cache for installation tokens.\nDue to the absence of access control checks at the cache retrieval layer, the system returns the cached token belonging to the victim tenant to the attacker's session. The attacker subsequently intercepts this bearer token and uses it to authenticate against the GitHub API.\nOnce the attacker possesses the GitHub App installation token, they can impersonate the app for the victim's organization. This bypasses the need for the attacker to possess original GitHub credentials or secondary authentication tokens. The scope of impact is dependent on the permissions granted to the GitHub App installation, which typically includes full access to repository code, secrets, webhooks, and workflow configurations.\nThis vulnerability affects YouTrack versions prior to 2026.2.18634 and exists regardless of the underlying infrastructure hosting, provided it is a shared-process multi-tenant configuration. The exploit requires no specific privilege escalation; standard user access is sufficient to query the state of the shared cache if the application logic allows for the inspection or triggering of cached token retrieval operations."
}