CVE-2026-118696 in CLion
Summary
by MITRE • 10/30/2026
In JetBrains IntelliJ IDEA, PyCharm, PhpStorm, RubyMine and WebStorm before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.6.2; GoLand before 2026.3, 2026.2.4, 2026.1.5.1, and 2025.3.5.2; Rider before 2026.3, 2026.2.4, 2026.1.5.3, and 2025.3.5.3; CLion before 2026.3, 2026.2.4.1, 2026.1.5.2, and 2025.3.6.3; DataGrip before 2026.3, 2026.2.6.1, 2026.1.4.1, and 2025.3.6.1; RustRover before 2026.3, 2026.2.5, 2026.1.4.1, and 2025.3.7.1; DataSpell before 2026.1.3.1 and 2025.3.3.1, the embedded browser trusted revoked intermediate certificates
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The identified vulnerability affects a broad spectrum of JetBrains integrated development environments including IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm, GoLand, Rider, CLion, DataGrip, RustRover, and DataSpell. The flaw resides within the embedded web browser component utilized by these applications for rendering help documentation, plugin marketplace interfaces, and other internal UI elements that rely on web technologies. Specifically, the vulnerability stems from an improper validation of X.509 certificate chains during Transport Layer Security handshakes. In a standard secure communication scenario, clients must verify not only the validity period and signature of the server's leaf certificate but also ensure that every intermediate certificate in the chain has not been revoked by its issuing Certificate Authority. The affected versions fail to adequately check revocation status for trusted intermediate certificates, allowing connections to proceed even if an intermediary authority has had its trust revoked due to security compromises or policy violations.
This technical flaw aligns with CWE-295 Improper Certificate Validation and falls under the ATT&CK technique T1078 Valid Accounts when exploited in conjunction with credential theft via man-in-the-middle attacks, although it primarily represents a configuration and validation weakness rather than an authentication bypass per se. By trusting revoked intermediate certificates, the application effectively lowers its security posture regarding certificate pinning and chain verification logic. An attacker positioned on the network path between the developer's machine and external services could potentially exploit this oversight to perform man-in-the-middle attacks against HTTPS connections made by the IDE itself. While modern browsers often use Online Certificate Status Protocol or OCSP stapling, older implementations or specific configurations within embedded browser engines may rely more heavily on local trust stores that do not dynamically update revocation lists with sufficient rigor in these legacy versions.
The operational impact of this vulnerability is significant for developers who handle sensitive codebases and proprietary information. If an attacker can intercept traffic to JetBrains services such as the plugin repository or license verification servers, they could potentially inject malicious plugins or tamper with updates without detection by the IDE's built-in security checks. This undermines the integrity of the development environment itself. Although direct remote code execution is not explicitly described in this specific certificate validation flaw, it creates a pathway for supply chain attacks where compromised software components are distributed through trusted channels that rely on these flawed TLS validations. The risk extends to any scenario where the IDE communicates with external endpoints using HTTPS, as the absence of proper intermediate revocation checks means that certificates issued by previously compromised or revoked authorities remain accepted as valid.
Mitigation requires immediate upgrading to patched versions of all affected JetBrains products. Users should ensure they are running IntelliJ IDEA version 2026.3 or later, along with specific patch levels for other tools such as PyCharm 2026.2.4 and GoLand 2025.3.5.2 as listed in the advisory. Until upgrades can be performed, organizations should consider network-level controls to monitor TLS connections originating from IDE processes and restrict outbound traffic to only known trusted domains where possible. Additionally, enabling strict certificate validation policies at the operating system level or through endpoint security solutions may provide a layer of defense against certificates issued by compromised authorities. Regularly updating development tools is critical not just for feature enhancements but for maintaining robust cryptographic hygiene within the software supply chain.