CVE-2026-75057 in IntelliJ IDEA
Summary
by MITRE • 08/17/2026
In JetBrains IntelliJ IDEA before 2026.1.5 git credentials were written in plaintext to the IDE log
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/17/2026
A critical security vulnerability has been identified within JetBrains IntelliJ IDEA versions prior to build 2026.1.5, specifically concerning the handling and logging of Git authentication credentials. The flaw manifests as an improper neutralization of special elements during input processing, leading to the direct exposure of sensitive user data in plaintext format. When developers interact with version control systems integrated into the IDE, such as cloning repositories or pushing changes via HTTPS, the application is required to handle username and password combinations or token strings for authentication purposes. In affected versions, instead of masking these credentials or omitting them from diagnostic output entirely, the software logs the raw values directly into its internal log files. This behavior represents a significant lapse in secure coding practices regarding sensitive data handling and logging protocols.
The technical root cause lies in the failure to sanitize input before writing it to persistent storage mechanisms used for debugging and error reporting. By default, many integrated development environments capture extensive diagnostic information to assist developers in troubleshooting issues with plugins or version control integrations. However, this convenience feature becomes a severe liability when it inadvertently captures authentication material. The vulnerability allows any user or process with read access to the local log files on the developer's machine to view these plaintext credentials. This exposure is particularly dangerous because Git credentials often serve as long-lived tokens that provide broad access to remote repositories, potentially including private source code, proprietary algorithms, and sensitive intellectual property.
From an operational perspective, this vulnerability poses a high risk of unauthorized data disclosure and potential compromise of version control systems. An attacker with physical or logical access to the developer's workstation could extract these log files and harvest valid credentials without triggering standard security alerts associated with brute-force attacks or anomalous login patterns. Furthermore, if developers routinely copy-paste logs into support tickets, issue trackers, or collaborative communication channels like Slack or Microsoft Teams for troubleshooting purposes, there is a substantial risk of external exposure to third parties. This scenario aligns closely with the Common Weakness Enumeration category CWE-532, which defines information exposure through log files, and also relates to CWE-798 regarding the use of hardcoded credentials if tokens are stored in configuration files that get logged alongside other settings.
The impact extends beyond simple credential theft. Compromised Git accounts can be leveraged for supply chain attacks where malicious code is injected into public or private repositories under a trusted developer's identity. This undermines the integrity of software projects and erodes trust within development teams. Additionally, many organizations enforce strict compliance requirements regarding data protection and audit trails; logging plaintext passwords violates principles outlined in standards such as OWASP Secure Coding Practices and general security hygiene guidelines that mandate the masking of sensitive information like passwords, credit card numbers, and personal identifiable information in all system outputs.
To mitigate this risk, immediate action is required to upgrade JetBrains IntelliJ IDEA to version 2026.1.5 or later, where this logging behavior has been corrected to exclude credential data from diagnostic logs. In the interim, for environments that cannot be immediately patched, administrators and developers should manually review local log directories for any leaked credentials and rotate all affected Git tokens and passwords as a precautionary measure. It is also advisable to configure IDE settings to reduce verbose logging levels during routine operations or to disable specific plugins that may contribute excessive diagnostic output until the patch is applied. Organizations should enforce policies that restrict access to user home directories and log folders to prevent unauthorized reading of these files, thereby adding a layer of defense-in-depth against local privilege escalation attacks that might exploit this information leakage.