CVE-2026-123846 in IntelliJ IDEA
Summary
by MITRE • 11/06/2026
In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/06/2026
A critical security vulnerability has been identified within the JetBrains IntelliJ IDEA integrated development environment, specifically affecting versions prior to the release of version 2026.3. This flaw manifests as a Server-Side Request Forgery (SSRF) issue that operates through blind execution vectors during the JSON Schema validation process. The core technical deficiency lies in how the IDE handles remote references embedded within JSON schema definitions. When developers configure or validate project structures using JSON schemas, IntelliJ IDEA attempts to resolve external reference URLs defined by the user or inherited from plugins and templates. In vulnerable versions, this resolution mechanism fails to adequately sanitize or restrict the destination of these HTTP requests, allowing an attacker who can influence the content of a loaded JSON schema to direct the application server to make network connections to arbitrary internal or external hosts.
The operational impact of this vulnerability is significant due to its potential for information disclosure and lateral movement within restricted networks. Because the SSRF is blind, the developer does not receive immediate feedback from the target service regarding whether the request succeeded or failed. This characteristic makes exploitation more challenging but also allows it to bypass many traditional detection mechanisms that rely on response analysis. An attacker could potentially use this vector to probe internal network services that are not exposed to the public internet, such as database servers, administrative interfaces of other development tools, or cloud metadata endpoints like those found in AWS EC2 instances. By crafting a malicious JSON schema file and tricking a developer into opening it within IntelliJ IDEA, an adversary could extract sensitive data from these internal resources by encoding the response content into DNS queries or HTTP request parameters directed to a server under their control.
This vulnerability aligns with CWE-918, which classifies Server-Side Request Forgery flaws where the web application retrieves a remote resource without validating the user-supplied URL. Furthermore, it maps to MITRE ATT&CK technique T1557, specifically Adversary-in-the-Middle or Lateral Tool Transfer scenarios where an attacker uses compromised systems as proxies for further attacks against other internal resources. The lack of input validation on the schema references represents a fundamental failure in secure coding practices regarding network resource access control. Developers relying on IntelliJ IDEA for complex project configurations are at risk if they incorporate untrusted JSON schemas into their workflow, particularly when collaborating with external partners or integrating third-party plugins that may inject malicious schema definitions.
To mitigate this risk, JetBrains has released version 2026.3 which addresses the underlying logic error in the JSON Schema validator. Users must upgrade to this latest version immediately to ensure that remote references are properly validated and restricted to allow-listed domains if such functionality is required for legitimate development purposes. In environments where upgrading is not immediately feasible, administrators should enforce strict network segmentation policies to limit IntelliJ IDEA processes from accessing internal subnets directly. Additionally, organizations should implement web application firewalls or proxy solutions that inspect outbound traffic generated by IDEs and block requests to suspicious IP ranges or known cloud metadata endpoints. Security teams should also audit existing JSON schema files for any embedded remote references that could be exploited until the patch is fully deployed across all development workstations.