low · CVSS v3 3.3
CVE-2026-123312
JetBrains IntelliJ IDEA versions prior to 2026.3 and 2026.2.4 are vulnerable to Server Side Request Forgery (SSRF) via annotations.xml files
Overview
JetBrains IntelliJ IDEA versions prior to 2026.3 and 2026.2.4 are vulnerable to Server Side Request Forgery (SSRF) via annotations.xml files during indexing. Attackers can trigger outbound requests to internal services, potentially exposing internal network information. The flaw does not allow direct code execution or data modification.
Description
In JetBrains IntelliJ IDEA before 2026.3, 2026.2.4 sSRF was possible via annotations.xml files during indexing
Impact
Confidentiality: internal IP addresses and service endpoints may be disclosed. Integrity: no direct modification of data. Availability: minimal impact. Defenders: developers, DevOps, and security teams using IntelliJ IDEA should be aware of the risk.
Remediation
Upgrade IntelliJ IDEA to version 2026.3 or later. If an upgrade is not immediately possible, disable automatic indexing of annotations.xml or configure the IDE to ignore external URLs during indexing. Apply any vendor patches as soon as they are released.
Risk context
The CVE has a low severity rating with a CVSS v3 score of 3.3 and no EPSS data available. While the risk is low, the potential for internal network exposure makes timely patching advisable.
Affected products
- JetBrains IntelliJ IDEA 2026.2.4
- JetBrains IntelliJ IDEA 2026.3
Scores
- Severity
- low
- CVSS v2
- 2.1
- CVSS v3
- 3.3
- CVSS v4
- —
- EPSS
- —