Server-Side Request Forgery (SSRF) in IntelliJ IDEA - CVE-2026-123307
Published: November 6, 2026
Vulnerability identifier: #VU159673
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-123307
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to cause IntelliJ IDEA to connect to an arbitrary host without authentication.
The vulnerability exists due to insufficient restriction of connection destinations in run configurations when establishing outbound connections. A remote attacker can abuse run configurations to induce connections to arbitrary hosts, potentially accessing services that would otherwise be inaccessible.
Affected software
IntelliJ IDEA
How to mitigate CVE-2026-123307
Install security update from vendor's website.
IntelliJ IDEA - addressed in versions 2026.2.4, 2026.3