CVE-2026-100279: SSRF
Published Sep 30, 2026
·Updated
In JetBrains YouTrack before 2026.2.19197 changing an integration URL exposed its stored credentials
Affected Software
1 affected component
JetBrains YouTrack<2026.2.19197
Event History
Sep 30, 2026
CVE Published
via MITRE·03:17 PM
Data Sourced
via MITRE·03:17 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which YouTrack instances should be remediated?
Instances running a version before 2026.2.19197 are affected. Upgrading to 2026.2.19197 or later addresses the issue.
2
What level of access would an attacker need?
The vulnerability is remotely reachable and requires low privileges. No user interaction is required.
3
What is the primary security impact?
Changing an integration URL could expose credentials stored for that integration. The reported impact is high confidentiality impact, with no reported integrity or availability impact.