JetBrains Patches 61 Flaws Across Hub, Datalore, YouTrack, and IntelliJ IDEA

TL;DR

JetBrains released a huge batch of JetBrains security updates to fix 61 bugs across nine tools. The patches resolve two critical flaws, CVE-2026-123294 in Hub and CVE-2026-123279 in Datalore, plus 20 high-risk bugs. Admins and devs must update their software right away to block code execution and account takeovers.

Notable CVEs

Why It Matters

JetBrains tools power build pipelines, issue trackers, and data workspaces for millions of coders worldwide. Therefore, bugs in central servers like Hub, YouTrack, and Datalore put source code and user logins at high risk.

Currently, neither source reports any active attacks in the wild or public exploit code for these flaws. While exact version counts remain private, over 11 million devs use JetBrains tools globally.

How the Attack Works

Critical Flaws in Hub and Datalore

First, the worst bug is CVE-2026-123294 (CVSS 9.6) in JetBrains Hub. An attacker can change email login details during the check flow to gain admin rights (CWE-915). Hub also had CVE-2026-123295 (CVSS 8.1), which lets users turn off enforced two-factor login via the profile route. Moreover, CVE-2026-123296 (CVSS 7.5) allows privilege escalation through fake email checks.

Second, CVE-2026-123279 (CVSS 9.0) hits JetBrains Datalore through a weak access check (CWE-863). Consequently, view-only users can run arbitrary code inside a notebook task. Datalore also fixed CVE-2026-123280 (CVSS 8.1), which lets unauthenticated users run code via public reports. In addition, CVE-2026-123281 (CVSS 7.5) lets notebook code run commands in the sidecar container.

High-Risk Bugs in YouTrack, Ktor, and IDEs

Third, YouTrack got 15 fixes led by CVE-2026-123323 (CVSS 8.4). In that bug, weak URL checks let apps send REST requests without user consent. Other YouTrack bugs leak shared mailbox history (CVE-2026-123324) and issue text (CVE-2026-123327) or load untrusted code (CVE-2026-123325). Meanwhile, Ktor fixed a session forgery bug via tampered cookies (CVE-2026-123317, CVSS 8.1).

Finally, desktop IDEs and CLI tools also needed urgent JetBrains security updates. Specifically, IntelliJ IDEA patched 15 bugs, including OpenAPI XSS (CVE-2026-123301, CVSS 8.2). It also fixed code execution in untrusted projects via script engines (CVE-2026-123302), ShellCheck (CVE-2026-123304), and Terraform paths (CVE-2026-123293). Similarly, WebStorm fixed task loader bugs (CVE-2026-123321), CLion patched a GDB profile flaw (CVE-2026-123276), and Junie CLI fixed command runs (CVE-2026-123315).

Affected Versions

These flaws hit JetBrains Hub before 2026.2.52556, Datalore before 2026.4, and YouTrack before 2026.2.19728. They also affect Ktor before 3.6.1, Junie CLI before 26.8.24, and Toolbox App before 3.9. Furthermore, the IDE bugs hit CLion, WebStorm, and IntelliJ IDEA builds prior to version 2026.3 and the latest 2026.2.4 point updates.

Patch and Mitigation Steps

Teams should install the latest JetBrains security updates right away. Server admins must update Hub to 2026.2.52556, Datalore to 2026.4, YouTrack to 2026.2.19728, and Ktor to 3.6.1. Likewise, devs must update IntelliJ IDEA, WebStorm, and CLion to 2026.3 or 2026.2.4, Junie CLI to 26.8.24, and Toolbox App to 3.9. Finally, coders should never open untrusted project folders outside Safe Mode.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.