Server-Side Request Forgery (SSRF) in IntelliJ IDEA - CVE-2026-123312
Published: November 6, 2026
Vulnerability identifier: #VU159686
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-123312
CWE-ID: CWE-918
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to induce IntelliJ IDEA to send requests to unintended destinations.
The vulnerability exists due to insufficient restriction of outbound requests in the IntelliJ IDEA indexing functionality when processing annotations.xml files. A remote attacker can supply a specially crafted annotations.xml file to trigger server-side request forgery during indexing.
Affected software
IntelliJ IDEA
How to mitigate CVE-2026-123312
Install security update from vendor's website.
IntelliJ IDEA - addressed in versions 2026.2.4, 2026.3