Description

In JetBrains IntelliJ IDEA before 2026.2.2 missing TLS and authentication on the IJent gRPC server allowed local code execution on Remote Development hosts

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.4",
  "pubDate": "2026-09-07T17:17:28.670Z",
  "pubdate": "2026-09-07T17:17:28.670Z",
  "executiveSummary": "A critical security vulnerability exists in JetBrains IntelliJ IDEA versions prior to 2026.2.2 related to the IJent gRPC server implementation.\nThe vulnerability is characterized by a failure to enforce TLS encryption and authentication mechanisms for the gRPC interface.\nThis flaw enables local attackers to interact with the IJent server without valid credentials, leading to Remote Code Execution (RCE) on Remote Development hosts.\nThe risk implication is severe, as the lack of access controls allows an unauthorized local entity to execute arbitrary code within the context of the IDE's remote development session.\nAttackers do not require pre-existing authentication to the IDE to exploit this vector, provided they have local access to the host environment where the gRPC server is listening.\nThis vulnerability highlights a significant failure in secure communication protocols and service authorization for inter-process components in the JetBrains Remote Development architecture.",
  "technicalDetails": "The vulnerability resides within the IJent gRPC server component utilized by JetBrains IntelliJ IDEA for facilitating Remote Development capabilities.\nThe root cause is identified as the absence of mandatory TLS encryption and a lack of authentication enforcement for the gRPC service endpoints.\nIJent serves as a bridge for remote development, handling backend processes; by neglecting to secure the gRPC communication channel, the component exposes its internal API to any local user or malicious process residing on the same host.\nThe attack flow begins with the discovery of the gRPC server port exposed on the local loopback or network interface.\nAn attacker can craft malicious gRPC requests to invoke methods exposed by the IJent server without providing cryptographic proof of identity or valid authorization tokens.\nBecause the server lacks authentication checks, it processes these unauthorized requests as trusted instructions.\nThe lack of TLS encryption facilitates this interaction, as there is no requirement for mutual authentication (mTLS) or secure handshake procedures that would otherwise validate the client.\nAn attacker can leverage these unauthenticated calls to manipulate the remote development environment, ultimately achieving Remote Code Execution (RCE).\nPost-exploitation, the attacker gains the ability to execute arbitrary code with the privileges of the user running the IDE process on the remote host.\nThis impact extends to the full control of the development environment, potential data exfiltration from source code repositories, and persistence within the development server.\nAffected versions include all JetBrains IntelliJ IDEA releases prior to 2026.2.2.\nThe vulnerability is specifically relevant to Remote Development deployments where the IJent server is active and accessible via the host's networking stack."
}