# Multiple JetBrains Product Vulnerabilities: Account Takeover, Privilege Escalation, and RCE Across Hub, YouTrack, IntelliJ IDEA, Kotlin, GoLand, and TeamCity

> JetBrains patched a cluster of vulnerabilities across its developer-tool ecosystem (Hub, YouTrack, IntelliJ IDEA, Kotlin, GoLand, TeamCity) spanning authentication bypass, privilege escalation, information disclosure, and multiple remote-code-execution primitives. The flaws chain plausibly: identity/SSO compromise in Hub or YouTrack combined with RCE in TeamCity or IntelliJ IDEA enables end-to-end takeover of a software supply chain, from developer workstation to CI/CD build infrastructure.

- **Published:** 2026-07-02T00:00:00Z
- **Last reviewed:** 2026-07-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1069
- **ID:** TL-2026-1069
- **Severity:** HIGH (CVSS 9.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-25848, CVE-2026-53914, CVE-2026-53915, CVE-2026-49366, CVE-2026-49369, CVE-2026-49370, CVE-2026-49373, CVE-2026-49374, CVE-2026-49376, CVE-2026-49378, CVE-2026-49382, CVE-2026-49385, CVE-2026-49386, CVE-2026-33392, CVE-2026-44413

## Description

JetBrains disclosed and fixed a wide-ranging set of security issues affecting its identity/administration hub (Hub), issue tracker (YouTrack), the Kotlin compiler toolchain, the GoLand IDE, IntelliJ IDEA, and the TeamCity CI/CD server, largely in the May-June 2026 patch cycle. The cluster spans several distinct root causes: (1) authentication and authorization weaknesses in Hub and YouTrack, including a critical (CVSS 9.8) authentication bypass allowing unauthenticated administrative actions (CVE-2026-25848, fixed in Hub 2025.3.119807), plus multiple YouTrack access-control and information-disclosure bugs (CVE-2026-49369, CVE-2026-49370, CVE-2026-49385, CVE-2026-49386); (2) unsafe deserialization in the Kotlin compiler's build-cache metadata handling enabling arbitrary code execution during build operations (CVE-2026-53914, CWE-502, fixed in Kotlin 2.4.20); (3) remote code execution in GoLand when opening a project with untrusted, attacker-controlled configuration, driven by external control of file name/path (CVE-2026-53915, CWE-73, CVSS 8.8, fixed in GoLand 2026.1.3); (4) command injection in IntelliJ IDEA's filename-completion subsystem, where unsanitized filenames reach OS command construction (CVE-2026-49366, CWE-78, CVSS 7.8, fixed in IntelliJ IDEA 2026.1.1), and a related template-injection RCE in IntelliJ IDEA's Copyright plugin (CVE-2026-49382, CWE-1336, CVSS 7.8, fixed in IntelliJ IDEA 2026.1); a prior sandbox-bypass RCE was also fixed in YouTrack's template engine for high-privileged users (CVE-2026-33392, CWE-1336, CVSS 7.2); and (5) a cluster of TeamCity CI/CD server flaws fixed in TeamCity 2026.1: RCE via Perforce VCS-root connection settings (CVE-2026-49373, CWE-88, CVSS 7.1), improper authorization exposing build-configuration parameters including database credentials and API keys via the REST API (CVE-2026-49374, CWE-285/CWE-862, critical), insufficient username validation in the SAML SSO plugin enabling identity-provider assertion spoofing and full account takeover including administrator impersonation (CVE-2026-49376, CVSS 6.5), and information disclosure via parameter autocompletion exposing credentials to low-privileged users (CVE-2026-49378). These build on an already-disclosed high-severity TeamCity API-exposure/privilege-escalation issue (CVE-2026-44413, fixed in TeamCity 2026.1) from May 2026. The combined effect across the product line is that an attacker who compromises Hub/YouTrack identity infrastructure, or who gets a victim to open a malicious project/repository in an affected IDE, or who controls a TeamCity VCS connection (e.g., a malicious or compromised Perforce depot), can pivot to code execution on developer workstations or CI/CD build agents — a textbook software-supply-chain attack path. No CVE in this cluster is listed in the CISA Known Exploited Vulnerabilities catalog as of this writing; JetBrains' historical TeamCity path-traversal flaws (CVE-2024-27198/CVE-2024-27199) remain the only JetBrains entries in KEV, added in 2024 and referenced again by CISA in an April 2026 catalog update, underscoring that this vendor's on-premise CI/CD product has a track record of post-disclosure exploitation and should be prioritized for rapid patching.

## MITRE ATT&CK

- T1199 Trusted Relationship
- T1195 Supply Chain Compromise
- T1059 Command and Scripting Interpreter
- T1203 Exploitation for Client Execution
- T1204 User Execution
- T1078 Valid Accounts
- T1505 Server Software Component
- T1068 Exploitation for Privilege Escalation
- T1078 Valid Accounts
- T1211 Exploitation for Stealth
- T1140 Deobfuscate/Decode Files or Information
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1606 Forge Web Credentials
- T1110 Brute Force
- T1087 Account Discovery
- T1069 Permission Groups Discovery
- T1518 Software Discovery
- T1210 Exploitation of Remote Services
- T1213 Data from Information Repositories
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1565 Data Manipulation
- T1587 Develop Capabilities
- T1588 Obtain Capabilities

## Sources

- [JetBrains Vulnerabilities](https://cybersecuritynews.com/jetbrains-vulnerabilities/)
- [Fixed security issues](https://www.jetbrains.com/privacy-security/issues-fixed/)
- [CVE-2026-53914: CWE-502 in JetBrains Kotlin](https://radar.offseq.com/threat/cve-2026-53914-cwe-502-in-jetbrains-kotlin-66299bf348d594be)
- [NVD - CVE-2026-53915](https://nvd.nist.gov/vuln/detail/CVE-2026-53915)
- [NVD - CVE-2026-49370](https://nvd.nist.gov/vuln/detail/CVE-2026-49370)
- [NVD - CVE-2026-49369](https://nvd.nist.gov/vuln/detail/CVE-2026-49369)
- [NVD - CVE-2026-49385](https://nvd.nist.gov/vuln/detail/CVE-2026-49385)
- [NVD - CVE-2026-49386](https://nvd.nist.gov/vuln/detail/CVE-2026-49386)
- [NVD - CVE-2026-33392](https://nvd.nist.gov/vuln/detail/CVE-2026-33392)
- [CVE-2026-49366: JetBrains IntelliJ IDEA RCE Vulnerability](https://www.sentinelone.com/vulnerability-database/cve-2026-49366/)
- [CVE-2026-49382: JetBrains IntelliJ IDEA RCE Vulnerability](https://www.sentinelone.com/vulnerability-database/cve-2026-49382/)
- [CVE-2026-49373 | THREATINT](https://cve.threatint.eu/CVE/CVE-2026-49373)
- [JetBrains TeamCity, Improper Authorization (CWE-285), CVE-2026-49374](https://dailycve.com/jetbrains-teamcity-improper-authorization-cwe-285-cve-2026-49374-critical-dc-jun2026-102/)
- [TeamCity, Improper Input Validation, CVE-2026-49376](https://dailycve.com/teamcity-improper-input-validation-cve-2026-49376-medium-dc-jun2026-100/)
- [CVE-2026-25848 - JetBrains Hub Authentication Bypass Vulnerability](https://v2.cvefeed.io/vuln/detail/CVE-2026-25848)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1069