JetBrains Patches Critical Auth Bypass and Code Execution Flaws Across Hub, YouTrack and IntelliJ IDEA

JetBrains has shipped a coordinated set of security fixes across its core developer platform products, addressing critical authentication bypass vulnerabilities, remote code execution flaws, and privilege escalation paths that collectively affect Hub, YouTrack, IntelliJ IDEA, TeamCity, Kotlin, and GoLand. Several of the patched flaws require no authentication or user interaction to exploit, and recent 2024 to 2026 release lines are confirmed affected, meaning even organisations running relatively current versions of JetBrains products remain exposed until the latest patched builds are applied.

Hub: Unauthenticated Administrative Access

The most severe cluster of vulnerabilities affects JetBrains Hub, the centralised identity and access management platform that handles authentication and authorisation for the broader JetBrains ecosystem. CVE-2026-50242, classified as Critical under CWE-306, allows an attacker to bypass authentication entirely via direct database access, granting full administrative control over Hub without supplying valid credentials. The trust boundary between the application logic and the underlying data store is broken, meaning an attacker who can reach the database layer can extract or manipulate any identity or permission record within the platform.

A second Critical flaw in Hub, CVE-2026-56142, allows privilege escalation through unauthorised binding of authentication details from other user accounts to an attacker-controlled profile. In practice this means a lower-privileged attacker can attach higher-privilege credentials to their own account, effectively impersonating any user in the system including administrators. Both flaws are patched in Hub 2026.1.13757, with corresponding fixes available for the 2025.x and 2024.x branches.

Multi-tenant and shared Hub deployments carry compounded risk because these authentication bypass paths create cross-project data exposure: once administrative access is obtained through CVE-2026-50242, an attacker has visibility across every project, user, and permission set managed by that Hub instance, not only those associated with their own account.

YouTrack: Authentication Bypass and Sandbox Escape

YouTrack, JetBrains' issue-tracking and project management platform, shares the CVE-2026-50242 authentication bypass with Hub, confirming that the underlying vulnerability class affects multiple products within the JetBrains platform rather than being isolated to a single component. Alongside this, YouTrack carries a separate High-severity sandbox bypass leading to remote code execution, CVE-2026-33392, discovered and reported by Hacktron AI and researcher Rahul Maini. This flaw breaks out of YouTrack's execution sandbox and allows code to run on the host system, transforming a project management compromise into a server-level incident.

IntelliJ IDEA: Command Injection and Code With Me Guest Escalation

IntelliJ IDEA received patches for two High-severity issues with distinct exploitation vectors. CVE-2026-49366 is a command injection flaw in the IDE's filename completion feature, classified under CWE-78. When a developer invokes filename completion against attacker-controlled file paths, unsanitised filename input is processed in a way that allows operating system commands to execute with the privileges of the IDE process. Those privileges typically include access to source code repositories, SSH keys, signed commit credentials, and cloud provider API tokens cached on disk, making successful exploitation a direct path to wider developer environment compromise.

The second IntelliJ IDEA flaw, CVE-2026-49367, exploits the Code With Me collaboration feature. A low-privileged guest user in a Code With Me session can execute commands on the host system due to missing authorisation checks classified under CWE-862. This has direct relevance for GCC enterprise development teams that use Code With Me for remote collaboration, pair programming sessions, or onboarding, since any guest participant in a session on an unpatched host can use this flaw to execute code on the host machine. Both IntelliJ IDEA flaws are fixed in version 2026.1.1. Administrators are advised to disable guest collaboration features on any host that cannot be patched immediately.

A third IntelliJ IDEA vulnerability, CVE-2026-49382, involves template injection in the IDE's Copyright plugin. An attacker who can distribute a project containing a crafted copyright profile under .idea/copyright/ can embed template expressions that execute arbitrary code when the IDE processes the template during file operations. Although this flaw requires local access and user interaction to trigger, the common delivery mechanism of public Git repositories and shared project archives makes it a realistic supply chain risk for development teams that regularly clone external repositories. This flaw is patched in IntelliJ IDEA 2026.1. The Cordyceps CI/CD supply chain research published this week demonstrated that developer tooling trust boundaries are under sustained and sophisticated attack. The IntelliJ IDEA Copyright plugin template injection is another concrete example of how opening an untrusted project in a developer IDE can compromise the entire development environment without any network-level exploitation.

TeamCity, Kotlin, and GoLand

JetBrains has also released patched builds for TeamCity, addressing remote code execution and authentication bypass paths that can be chained with compromised accounts to complete a full build environment takeover. Kotlin and GoLand received patched versions closing additional execution-level vulnerabilities. In multi-tenant TeamCity environments or shared CI/CD pipelines, where guest access, remote development, or untrusted project integration is common, the risk of cross-project build tampering following a successful authentication bypass is significant. Administrators running self-hosted TeamCity instances should rotate all credentials and build configuration tokens as part of the remediation process, regardless of whether exploitation is suspected, because the authentication bypass paths could have allowed undetected access prior to the patch.

GCC Enterprise Exposure

JetBrains tools are embedded across enterprise software development operations throughout Saudi Arabia, the UAE, and wider Gulf markets. Financial services institutions building proprietary banking and payments platforms, telecommunications companies maintaining custom network management software, government digital transformation programmes, and the GCC's growing fintech and startup ecosystem all commonly run JetBrains Hub for identity management, YouTrack for project tracking, IntelliJ IDEA across developer workstations, and TeamCity for CI/CD pipelines. The authentication bypass paths in Hub and YouTrack are of particular concern in enterprise environments where JetBrains products are integrated with Active Directory or LDAP, since a Hub compromise can cascade into the connected identity infrastructure.

For GCC enterprises operating under UAE NESA Information Assurance Standards or Saudi NCA Essential Cybersecurity Controls, developer platform security falls within documented requirements for patch management of enterprise software systems and protection of source code and development infrastructure as sensitive intellectual property. An authentication bypass granting unauthenticated administrative access to the identity management platform that underpins a development operation is not a low-priority finding. It should be treated with the same urgency applied to network perimeter and cloud infrastructure advisories.

Required Actions

• Upgrade Hub to version 2026.1.13757 or the corresponding patched build for your 2025.x or 2024.x branch immediately.
• Upgrade IntelliJ IDEA to 2026.1.1. Upgrade YouTrack to the latest available version incorporating the CVE-2026-33392 and CVE-2026-50242 fixes.
• Apply the latest patched releases for TeamCity, Kotlin, and GoLand. Disable the IntelliJ IDEA Copyright plugin and Code With Me guest access features on any host that cannot be patched within the current maintenance window.
• Restrict and monitor any direct database access paths to Hub and YouTrack instances.
• Rotate all build configuration tokens and credentials in TeamCity.
• Review Hub audit logs for unexpected privilege changes, account binding events, or administrative actions that cannot be attributed to known authorised users.