CVE-2026-123846: SSRF
Published Nov 6, 2026
·Updated
In JetBrains IntelliJ IDEA before 2026.3 blind SSRF was possible via remote references in JSON Schema validation
Event History
Nov 6, 2026
CVE Published
via MITRE·04:10 PM
Data Sourced
via MITRE·04:10 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·05:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which IntelliJ IDEA releases require remediation?
IntelliJ IDEA versions before 2026.3 are affected. Upgrading to 2026.3 or later addresses the issue.
2
When is an installation exposed to this issue?
Exposure occurs in the JSON Schema validation workflow when schemas contain remote references. The issue can result in blind server-side requests to those referenced locations.