CVE-2026-86506
Received Received - Intake

Authentication Bypass in GoLand Profiler Exposes Data

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: JetBrains s.r.o.

Description
In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-86506
EUVD
EUVD-2026-72522

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
jetbrains goland to 2026.2.2.1 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-306 The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

In JetBrains GoLand before 2026.2.2.1, there is a missing authentication mechanism on the GoLand profiler's injected pprof server. This flaw allows unauthorized access to profiling data, which could expose sensitive information about the application's performance and execution.

Detection Guidance

Check if GoLand is running with the profiler enabled by inspecting active network connections on port 6060 or similar profiling ports. Use commands like 'netstat -tulnp | grep 6060' or 'ss -tulnp | grep 6060' to detect listening pprof servers.

Impact Analysis

This vulnerability could allow attackers to access profiling data, potentially revealing sensitive details about your application's behavior, performance bottlenecks, or internal workings. This information might be used to craft further attacks or gain insights into proprietary software.

Mitigation Strategies

Upgrade GoLand to version 2026.2.2.1 or later to address the missing authentication issue. If upgrading is not immediately possible, disable the profiler or restrict network access to the pprof server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-86506. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart