CVE-2026-75054 in IntelliJ IDEA
Summary
by MITRE • 08/17/2026
In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/17/2026
The vulnerability identified involves a Server-Side Request Forgery (SSRF) flaw within the OpenAPI preview proxy functionality of JetBrains IntelliJ IDEA prior to version 2026.2.1. This security issue specifically affects environments where developers are working with untrusted or externally sourced projects, exposing the integrated development environment to malicious network requests initiated by compromised project configurations. The core technical flaw lies in how the IDE handles URL validation and request routing when processing OpenAPI specifications through its built-in preview mechanism. Instead of strictly validating that requested resources originate from safe, local, or explicitly whitelisted domains, the proxy allows attackers to manipulate input parameters to redirect internal requests toward arbitrary destinations on the network.
This SSRF vulnerability enables an attacker who can influence the project configuration files or OpenAPI specification documents to force IntelliJ IDEA to make HTTP requests to internal services that are otherwise inaccessible from the public internet. By leveraging this misconfiguration, a malicious actor could potentially access sensitive internal APIs, retrieve confidential data stored in local databases, or interact with cloud metadata endpoints such as those found on Amazon EC2 instances at 169.254.169.254 to steal temporary security credentials. The operational impact is significant because it bypasses traditional network perimeter defenses that rely on restricting external access while allowing internal service communication for development purposes.
The attack vector typically involves crafting a malicious OpenAPI specification file or modifying an existing one within the project structure. When the developer opens this untrusted project in IntelliJ IDEA and triggers the preview feature, the IDE processes the specification through its proxy component without adequate sanitization of host addresses. This allows the injection of internal IP ranges or localhost references that are processed as valid targets for request forwarding. The vulnerability is particularly dangerous because it exploits a trusted development tool, leading users to lower their guard regarding input validation and network security policies within their IDE settings.
From an industry standard perspective, this flaw aligns with CWE-918, which describes Server-Side Request Forgery (SSRF) flaws where the server makes requests based on user-supplied data without proper validation. It also relates to CWE-20, Improper Input Validation, as the IDE fails to adequately sanitize or validate the host and port information provided in the OpenAPI definition before executing network operations. In terms of MITRE ATT&CK mapping, this vulnerability facilitates techniques associated with T1583, specifically Acquire Infrastructure: Virtual Private Server or Cloud Instance, if used for initial access staging, but more directly maps to reconnaissance activities such as T1046, Network Service Discovery, where the attacker uses the compromised IDE to map internal network services and identify potential targets for further exploitation.
Mitigation strategies primarily involve upgrading JetBrains IntelliJ IDEA to version 2026.2.1 or later, which includes patches that enforce stricter validation rules on URLs processed by the OpenAPI preview proxy. Developers should exercise caution when opening projects from untrusted sources, ensuring they review configuration files before activating features that interact with external networks. Additionally, organizations can implement network segmentation policies to restrict IDEs from accessing sensitive internal subnets and utilize web application firewalls or reverse proxies to inspect outbound traffic generated by development tools for anomalous patterns indicative of SSRF attempts. Regular security training regarding the risks associated with untrusted codebases and configuration files is also recommended to reduce the likelihood of successful exploitation in enterprise environments.