CVE-2026-123843 in IntelliJ IDEA
Summary
by MITRE • 11/06/2026
In JetBrains IntelliJ IDEA before 2026.3 untrusted projects could trigger changes to GPG agent configuration
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified in versions of JetBrains IntelliJ IDEA prior to version 2026.3 involves a critical flaw in how the integrated development environment handles project configurations related to cryptographic operations, specifically those involving GNU Privacy Guard or GPG agents. This issue stems from an insufficient validation mechanism when processing untrusted projects that contain specific configuration files designed to interact with external security tools. When a developer opens such a project, particularly one sourced from an unknown or potentially malicious repository, the IDE automatically applies settings defined within the project structure directly to the host system's GPG agent environment without adequate sanitization or user confirmation for these systemic changes.
From a technical perspective, this flaw represents a classic case of insecure configuration management where application-level inputs are treated as trusted directives affecting global system state. The vulnerability allows an attacker who controls the content of a project file to manipulate the behavior of the GPG agent running on the victim's machine. This can include altering keybox locations, changing trust model settings, or modifying how signatures and encryption requests are processed by the underlying cryptographic subsystem. By exploiting this mechanism, a malicious actor could potentially bypass security checks enforced by the user’s personal GPG configuration, leading to unauthorized access to private keys or the ability to forge digital signatures that appear legitimate under standard verification processes.
The operational impact of this vulnerability is significant for developers who rely on IntelliJ IDEA for secure software development practices involving code signing, commit signing with Git using GPG, and encrypted communication workflows. An attacker could leverage this flaw to compromise the integrity of signed commits or releases, effectively undermining non-repudiation guarantees provided by public key infrastructure. Furthermore, if the altered configuration causes the GPG agent to behave unpredictably, it may lead to denial of service conditions where legitimate cryptographic operations fail silently or produce incorrect results, thereby corrupting audit trails and version control histories that depend on accurate signature verification.
This issue aligns with CWE-16 known as Configuration which allows an attacker to modify settings in a way that compromises security controls. It also maps closely to MITRE ATT&CK technique T1553 Subvert Trust Controls, specifically the subcategory S-Mark Signature Code Signing where adversaries manipulate trust mechanisms to execute malicious code or hide their activities under the guise of legitimate signed artifacts. The exploitation vector typically involves social engineering tactics such as distributing a seemingly benign project archive that contains hidden configuration payloads targeting the IDE’s integration points with system-level cryptographic services.
Mitigation strategies for this vulnerability primarily involve upgrading JetBrains IntelliJ IDEA to version 2026.3 or later, where these validation checks have been strengthened to prevent untrusted projects from automatically altering global agent configurations. In environments where immediate patching is not feasible, administrators should enforce strict policies regarding the opening of external project files and disable automatic configuration imports for GPG-related settings within the IDE preferences. Additionally, users are advised to monitor their GPG agent logs for unexpected changes in keybox paths or trust model parameters after opening new projects, ensuring that any deviations from baseline configurations trigger immediate investigation and rollback procedures.