CVE-2026-86503
Received Received - Intake

SSRF in JetBrains IntelliJ IDEA via Kubernetes Spec-Source URL

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: JetBrains s.r.o.

Description
In JetBrains IntelliJ IDEA before 2026.2.2 opening an untrusted project could trigger SSRF via Kubernetes spec-source URL fetching

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86503
EUVD
EUVD-2026-72519

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jetbrains intellij_idea to 2026.2.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in JetBrains IntelliJ IDEA before 2026.2.2 allows an attacker to trigger SSRF (Server-Side Request Forgery) by opening an untrusted project that contains a malicious Kubernetes spec-source URL. This could lead to unauthorized requests being made from the affected system.

Detection Guidance

Detecting this vulnerability requires checking the version of JetBrains IntelliJ IDEA installed on your system. Compare it against version 2026.2.2 or later. If you are running an older version, the system may be vulnerable to SSRF via Kubernetes spec-source URL fetching when opening untrusted projects.

Impact Analysis

The impact includes potential unauthorized access to internal systems, data exfiltration, or further attacks on connected services. Since SSRF can bypass firewall restrictions, it may expose sensitive information or allow attackers to interact with internal APIs.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR (data protection) and HIPAA (health information privacy) requirements. Non-compliance risks include fines, legal penalties, and reputational damage due to unauthorized data exposure.

Mitigation Strategies

Immediately update JetBrains IntelliJ IDEA to version 2026.2.2 or later to address the SSRF vulnerability. Avoid opening untrusted projects until the update is applied. If updating is not possible, consider temporarily disabling Kubernetes integration features or restricting network access for IntelliJ IDEA.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86503. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart