JetBrains has released a wave of security updates across its product lineup, fixing multiple critical- and high-severity flaws that could let attackers bypass authentication controls and execute arbitrary code on affected systems.
The fixes span Hub, IntelliJ IDEA, GoLand, YouTrack, and TeamCity, with several bugs rated Critical or High. The most severe issues affect JetBrains Hub, the identity and access management layer underlying the JetBrains toolchain.
JetBrains Security Update
CVE-2026-56141, carrying a CVSS score of 9.8, stems from predictable account-restore codes generated by a weak random number generator (CWE-338), letting an unauthenticated attacker enumerate valid codes and seize any account, including administrator accounts.
A second Critical flaw, CVE-2026-50242 (CWE-306), allows authentication bypass via direct database access, granting administrative control without valid credentials.
A related privilege-escalation bug, CVE-2026-56142, permits attackers to attach unauthorized authentication details to existing accounts (CWE-915). All three are fixed in Hub 2026.1.13757 and corresponding patches for the 2025.x and 2024.x branches.
IntelliJ IDEA received fixes for two High-severity issues: CVE-2026-49366, a command injection flaw triggered via filename completion (CWE-78), and CVE-2026-49367, an authentication bypass that lets a low-privileged guest user in a Code With Me collaboration session execute commands on the host system (CWE-862).
JetBrains resolved both in IntelliJ IDEA 2026.1.1, and administrators are advised to disable guest collaboration features on unpatched hosts and rotate credentials handled by the IDE.
Separately, GoLand fixed CVE-2026-53915, a High-severity remote code execution bug triggered by loading untrusted project configuration files, patched in version 2026.1.3.
TeamCity On-Premises addressed CVE-2026-44413, a High-severity post-authentication flaw (CWE-306) that exposed the server API to unauthorized access under certain firewall configurations.
It was fixed in TeamCity 2026.1 and 2025.11.5, with a security patch plugin available for older branches. TeamCity also patched CVE-2026-49373, a High-severity command-injection RCE via Perforce connection settings.
YouTrack fixed a High-severity sandbox-bypass RCE, CVE-2026-33392, reported by Hacktron AI and researcher Rahul Maini, alongside a separate authentication bypass tracked as CVE-2026-50242 shared with Hub.
Affected Products and Fixes
| Product | Vulnerability | Severity | CVE | Fixed In |
|---|---|---|---|---|
| Hub | Account takeover via predictable restore codes | Critical | CVE-2026-56141 | 2026.1.13757 and prior branches |
| Hub | Auth bypass via direct DB access | Critical | CVE-2026-50242 | 2026.1.13757 and prior branches |
| IntelliJ IDEA | Command execution via guest account | High | CVE-2026-49367 | 2026.1.1 |
| GoLand | RCE via untrusted project config | High | CVE-2026-53915 | 2026.1.3 |
| TeamCity | API exposure/privilege escalation | High | CVE-2026-44413 | 2026.1, 2025.11.5 |
| YouTrack | Sandbox bypass leading to RCE | High | CVE-2026-33392 | 2025.3.131383 |
According to the JetBrains advisory, all customers running self-hosted instances of Hub, YouTrack, TeamCity, or affected desktop IDEs should upgrade immediately to the patched versions, as several of these flaws require no authentication or user interaction to exploit.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
