Description

In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.9",
  "pubDate": "2026-09-07T17:17:29.130Z",
  "pubdate": "2026-09-07T17:17:29.130Z",
  "executiveSummary": "JetBrains GoLand versions prior to 2026.2.2.1 contain a vulnerability involving the improper configuration of the internal pprof profiling server.\nThe vulnerability stems from missing authentication mechanisms, which permits unauthorized access to sensitive application profiling data.\nThis flaw exposes internal runtime metrics, stack traces, and memory allocation details of the Go application being debugged or profiled within the IDE environment.\nAn attacker with network access to the host machine or the interface where the pprof server is listening can extract highly sensitive information without providing credentials.\nThe risk is categorized as critical for development environments where sensitive code or data is processed, as it facilitates unauthorized information disclosure regarding the application's runtime state.\nExploitation requires no specialized privileges, provided the attacker can reach the endpoint established by the injected profiler.",
  "technicalDetails": "The vulnerability resides within the GoLand profiler implementation, specifically concerning the integrated pprof server injected into the target application's runtime.\npprof is the standard Go tool for profiling data collection; however, when injected by GoLand for diagnostic purposes, the server instance failed to enforce access control or authentication requirements.\nRoot cause analysis indicates that the profiling listener was bound to a network interface without secondary authorization checks, effectively defaulting to an open access model.\nAttack flow begins with the application running with the GoLand-injected profiler active. The profiler initializes an HTTP server, typically on a local loopback or exposed network interface, to serve profiling endpoints such as /debug/pprof/heap, /debug/pprof/goroutine, and /debug/pprof/profile.\nAn unauthenticated attacker performs an HTTP GET request to these endpoints. Due to the missing authentication layer, the profiler responds by streaming the requested runtime data, such as full heap dumps or active goroutine stack traces, directly to the requestor.\nThe impact of this disclosure is significant. By analyzing heap dumps, an attacker may recover sensitive variables, cryptographic keys, or session tokens resident in memory. Goroutine stack traces reveal the internal execution logic and state of the application, which assists in mapping the application's attack surface for further, more targeted exploitation.\nThe vulnerability affects all instances of JetBrains GoLand where the integrated pprof server is active prior to version 2026.2.2.1. While often assumed to be locally scoped, if the profiler is configured to bind to non-loopback addresses or is accessed via port forwarding/reverse proxy setups in complex development environments, the exposure extends beyond the immediate host.\nThere is no requirement for user interaction or administrative privileges for the attacker, provided the diagnostic server is reachable. The payload behavior is strictly limited to information disclosure, effectively turning the diagnostic tool into a reconnaissance instrument for unauthorized actors."
}