EN PT-BR
← Voltar ao feed
high technology

JetBrains patches 61 flaws across Hub, Datalore, YouTrack, Ktor and IDEs, including two critical bugs

1 fonte(s) · 1 atualização(ões) · publicado 06/11/2026 09:40 · coletado há 1 hora

JetBrains released security updates fixing 61 vulnerabilities across nine products: 2 critical, 20 high, 26 medium and 13 low. The critical flaws are CVE-2026-123294 in JetBrains Hub (CVSS 9.6) and CVE-2026-123279 in Datalore (CVSS 9.0). The article reports no exploitation in the wild and no public exploit code.

Entenda a falha

A vulnerabilidade

JetBrains fixed 61 flaws across nine products. The most severe is CVE-2026-123294 in Hub (CVSS 9.6): an attacker can alter email login details during the verification flow and gain admin rights (CWE-915). CVE-2026-123279 in Datalore (CVSS 9.0) is a weak access check (CWE-863) that lets view-only users run arbitrary code in a notebook task. Other notable bugs: Hub CVE-2026-123295 and CVE-2026-123296, Datalore CVE-2026-123280 (unauthenticated code execution via public reports) and CVE-2026-123281, YouTrack CVE-2026-123323, Ktor CVE-2026-123317 (session forgery), and IDE code execution in untrusted projects. Fixed in Hub 2026.2.52556, Datalore 2026.4, YouTrack 2026.2.19728, Ktor 3.6.1, Junie CLI 26.8.24, Toolbox App 3.9, and IntelliJ IDEA, WebStorm and CLion 2026.3 or 2026.2.4.

Como funciona

In Hub, the email verification flow accepts changes to the login email details while a verification is in progress, and the server acts on them in a way that leads to elevated admin rights. In Datalore, a user with view-only access triggers a notebook task, and the access check that should block execution does not stop it, so the code runs. In YouTrack, a weak URL check lets an app send REST requests without asking the user for consent. In the IDEs, opening an untrusted project makes script engines, ShellCheck or Terraform paths run code outside Safe Mode. The articles give no more step-by-step detail.

Por que é vulnerável

For Datalore CVE-2026-123279, the root cause is an incorrect authorization check (CWE-863) that does not restrict view-only users from running code. For Hub CVE-2026-123294, the weakness is classed as CWE-915, meaning attributes of an object (the email login details) can be modified when they should not be during verification. YouTrack's issue is insufficient URL validation. The articles do not explain why these went unnoticed or detail what each fix changes.

Como foi descoberta

The articles do not say who found the flaws or how. They only report that JetBrains released the security updates and that no active exploitation has been confirmed.

Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 10:16.

Detalhes técnicos

  • Hub: CVE-2026-123294 lets an attacker change email login details during the verification flow and gain admin rights (CWE-915). CVE-2026-123295 (CVSS 8.1) lets users disable enforced two-factor authentication through the profile route. CVE-2026-123296 (CVSS 7.5) allows privilege escalation through fake email verification.
  • Datalore: CVE-2026-123279 is a weak access check (CWE-863) that lets view-only users run arbitrary code in a notebook task. CVE-2026-123280 (CVSS 8.1) lets unauthenticated users run code through public reports. CVE-2026-123281 (CVSS 7.5) lets notebook code run commands in the sidecar container.
  • YouTrack: 15 fixes. CVE-2026-123323 (CVSS 8.4) is a weak URL check that lets apps send REST requests without user consent. Others leak shared mailbox history (CVE-2026-123324) and issue text (CVE-2026-123327), or load untrusted code (CVE-2026-123325).
  • Ktor: CVE-2026-123317 (CVSS 8.1) allows session forgery through tampered cookies.
  • IntelliJ IDEA: 15 fixes. They include OpenAPI XSS (CVE-2026-123301, CVSS 8.2) and code execution in untrusted projects through script engines (CVE-2026-123302), ShellCheck (CVE-2026-123304) and Terraform paths (CVE-2026-123293).
  • Other tools: WebStorm task loader (CVE-2026-123321), CLion GDB profile (CVE-2026-123276) and Junie CLI command execution (CVE-2026-123315).
  • Affected versions: Hub before 2026.2.52556, Datalore before 2026.4, YouTrack before 2026.2.19728, Ktor before 3.6.1, Junie CLI before 26.8.24, Toolbox App before 3.9. CLion, WebStorm and IntelliJ IDEA are affected before 2026.3 and the latest 2026.2.4 point updates.

Remediação

Update to Hub 2026.2.52556, Datalore 2026.4, YouTrack 2026.2.19728, Ktor 3.6.1, Junie CLI 26.8.24, Toolbox App 3.9, and IntelliJ IDEA, WebStorm and CLion 2026.3 or 2026.2.4. Open untrusted projects only in Safe Mode.

Linha do tempo

  1. securityonline.info ↗ · pub. 06/11/2026 09:40 · coletado 06/11 10:00 primeiro registro

    JetBrains patches 61 flaws across Hub, Datalore, YouTrack, Ktor and IDEs, including two critical bugs

    ler a análise desta fonte

    JetBrains released security updates fixing 61 vulnerabilities across nine products: 2 critical, 20 high, 26 medium and 13 low. The critical flaws are CVE-2026-123294 in JetBrains Hub (CVSS 9.6) and CVE-2026-123279 in Datalore (CVSS 9.0). The article reports no exploitation in the wild and no public exploit code.

    Technical Details

    • Hub: CVE-2026-123294 lets an attacker change email login details during the verification flow and gain admin rights (CWE-915). CVE-2026-123295 (CVSS 8.1) lets users disable enforced two-factor authentication through the profile route. CVE-2026-123296 (CVSS 7.5) allows privilege escalation through fake email verification.
    • Datalore: CVE-2026-123279 is a weak access check (CWE-863) that lets view-only users run arbitrary code in a notebook task. CVE-2026-123280 (CVSS 8.1) lets unauthenticated users run code through public reports. CVE-2026-123281 (CVSS 7.5) lets notebook code run commands in the sidecar container.
    • YouTrack: 15 fixes. CVE-2026-123323 (CVSS 8.4) is a weak URL check that lets apps send REST requests without user consent. Others leak shared mailbox history (CVE-2026-123324) and issue text (CVE-2026-123327), or load untrusted code (CVE-2026-123325).
    • Ktor: CVE-2026-123317 (CVSS 8.1) allows session forgery through tampered cookies.
    • IntelliJ IDEA: 15 fixes. They include OpenAPI XSS (CVE-2026-123301, CVSS 8.2) and code execution in untrusted projects through script engines (CVE-2026-123302), ShellCheck (CVE-2026-123304) and Terraform paths (CVE-2026-123293).
    • Other tools: WebStorm task loader (CVE-2026-123321), CLion GDB profile (CVE-2026-123276) and Junie CLI command execution (CVE-2026-123315).
    • Affected versions: Hub before 2026.2.52556, Datalore before 2026.4, YouTrack before 2026.2.19728, Ktor before 3.6.1, Junie CLI before 26.8.24, Toolbox App before 3.9. CLion, WebStorm and IntelliJ IDEA are affected before 2026.3 and the latest 2026.2.4 point updates.

    Remediation

    Update to Hub 2026.2.52556, Datalore 2026.4, YouTrack 2026.2.19728, Ktor 3.6.1, Junie CLI 26.8.24, Toolbox App 3.9, and IntelliJ IDEA, WebStorm and CLion 2026.3 or 2026.2.4. Open untrusted projects only in Safe Mode.