CVE-2026-103497 in YouTrack
Summary
by MITRE • 10/01/2026
In JetBrains YouTrack before 2026.2.19422 sSRF was possible via the GitHub VCS integration
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/01/2026
The vulnerability identified in JetBrains YouTrack prior to version 2026.2.19422 represents a critical security flaw within the platform's Version Control System (VCS) integration module, specifically concerning its interaction with GitHub repositories. This issue is classified as a Cross-Site Request Forgery (CSRF), also known as Session Riding, which exploits the trust that a web application has in the user's browser to perform unauthorized actions on behalf of an authenticated user without their knowledge or consent. In this specific context, the flaw resides within the configuration and management endpoints associated with linking GitHub repositories to YouTrack projects. The system fails to adequately validate the origin of requests when processing changes to VCS integration settings, allowing an attacker to craft malicious web pages that can trigger state-changing HTTP requests against the vulnerable application while a victim is logged in.
From a technical perspective, CSRF attacks leverage the fact that browsers automatically include credentials such as session cookies, HTTP authentication headers, or cookie-based authorization tokens with every request made to a target domain. When an authenticated user visits a malicious site controlled by an attacker, JavaScript code embedded within that page can initiate requests to the YouTrack instance's API endpoints responsible for adding or modifying GitHub VCS integrations. Because these requests are sent from the victim's browser and include their valid session tokens, the server processes them as legitimate administrative actions. This allows the attacker to silently add a malicious webhook, modify repository synchronization settings, or potentially exfiltrate data by linking external services that forward issue updates to an attacker-controlled endpoint. The absence of robust anti-CSRF tokens or strict SameSite cookie attributes in these specific integration endpoints creates the attack vector necessary for exploitation.
The operational impact of this vulnerability is significant due to the high-privilege nature of VCS integrations within project management tools like YouTrack. By manipulating GitHub integration settings, an attacker can disrupt the workflow integrity of development teams by injecting false issue updates or silencing legitimate notifications. More critically, if the integration allows for bidirectional synchronization or webhook execution, it could lead to unauthorized code deployment triggers or data leakage where sensitive project details are sent to external servers controlled by malicious actors. This undermines the confidentiality and integrity of the software development lifecycle managed through YouTrack, potentially exposing proprietary source code references, issue tracking metadata, and team collaboration history to third parties without authorization.
This vulnerability aligns with CWE-352, which defines Cross-Site Request Forgery as a weakness where an application does not verify whether requests are intended by the user. Furthermore, in terms of offensive security frameworks such as MITRE ATT&CK, this flaw facilitates techniques related to Command and Control via legitimate services or Data Exfiltration over Web Protocols if webhooks are misconfigured to send data externally. It also touches upon privilege escalation vectors where low-privileged users might exploit integration settings to gain broader access depending on the specific permissions granted to VCS configurations within the organization's role-based access control model.
To mitigate this risk, organizations running versions of YouTrack prior to 2026.2.19422 must immediately upgrade to the patched version where these CSRF protections have been implemented in the GitHub integration endpoints. In addition to upgrading, administrators should enforce strict SameSite cookie policies on all session cookies associated with the application to prevent browsers from sending them in cross-site requests by default. Implementing additional layers of defense such as Content Security Policy headers can further restrict the execution of malicious scripts that might attempt to forge these requests. Regular security audits and penetration testing focused on state-changing API endpoints are recommended to ensure that similar vulnerabilities do not exist elsewhere within the application's integration modules, particularly those involving external service connections like GitHub, GitLab, or Bitbucket.