JetBrainsCVE-2026-75054

JetBrains IntelliJ IDEA: server-side request forgery

Medium6.3CVE-2026-75054 · Published Aug 17, 2026 · updated Sep 11, 2026

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects

JetBrains advisory

Affected versions

Package	Affected	Fixed in
IntelliJ IDEA Product	< 2026.2.1	2026.2.1

Details and references

CVSS 3.1: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-918

More JetBrains advisories

Date	Advisory	Severity	Fixed in
Aug 17	JetBrains PyCharm: code execution Medium4.4Aug 17 CVE-2026-750592026.2.1	Medium4.4	2026.2.1
Aug 17	JetBrains PyCharm: remote code execution High8.4Aug 17 CVE-2026-750602026.2.1	High8.4	2026.2.1
Aug 17	JetBrains YouTrack: denial of service High7.1Aug 17 CVE-2026-750502026.1.13901+1 more	High7.1	2026.1.13901+1 more
Aug 17	JetBrains YouTrack: missing authorization High8.1Aug 17 CVE-2026-750512026.2.17917	High8.1	2026.2.17917
Aug 17	JetBrains IntelliJ IDEA: command injection Low3.6Aug 17 CVE-2026-750522026.2.1	Low3.6	2026.2.1
Aug 17	JetBrains IntelliJ IDEA: server-side request forgery Medium5.4Aug 17 CVE-2026-750532026.2.1	Medium5.4	2026.2.1

Critical advisories by email

Wednesdays: the week’s critical and high advisories in the AI and data stack, with the fixed versions. Only in weeks that have some.