CVE-2026-86486: Low severity JetBrains YouTrack vulnerability
In JetBrains YouTrack before 2026.2.18634 the generic VCS webhook handler failed open when its secret was blank
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
JetBrains YouTrack deployments before version 2026.2.18634 are affected when the generic VCS webhook handler is configured with a blank secret.
What must an attacker do to exploit the issue?
An attacker must be able to send a request to the generic VCS webhook handler. When its secret is blank, the handler fails open rather than enforcing webhook-secret validation.
Are default configurations affected?
The available information identifies exposure only when the generic VCS webhook handler's secret is blank. It does not state whether that is the default configuration.
What can be done before upgrading?
Configure a non-blank secret for the generic VCS webhook handler to avoid the identified fail-open condition. Upgrade YouTrack to version 2026.2.18634 or later when possible.