CVE-2026-75045

Executive Summary

CVE-2026-75045 is a critical (CVSS 9.1) authentication-bypass vulnerability in JetBrains YouTrack. An unauthenticated, remote attacker can exploit the shared draft signature mechanism to download database backups from an exposed YouTrack server, bypassing authentication entirely. Affected are all YouTrack deployments running builds before 2025.3.156085, 2026.1.13913, or 2026.2.18112. Successful exploitation results in total disclosure of the underlying database, including user records, hashed credentials, project data, and potentially integration secrets; the integrity impact indicates the attacker may also use recovered material to tamper with data or accounts.

Technical Analysis

The NVD description states: "In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature." This maps to CWE-288, "Authentication Bypass Using an Alternate Path."

The vulnerability class is an authorization-scope failure in a capability-based sharing mechanism. YouTrack's "shared draft" feature issues a signature that is intended to grant access to a specific draft artifact without requiring a full interactive session. The flaw is that the server accepts this signature as sufficient proof of authorization for an alternate, unrelated — and far more sensitive — resource: database backup archives. In CWE-288 terms, the application fails to validate the resource path against the scope of the supplied credential, so an unauthenticated actor who obtains or forges a valid shared draft signature can invoke the backup-download flow as if authorized.

Notable characteristics derivable from the CVSS vector:

• AV:N / PR:N / UI:N — the attack is fully remote, requires no account, and needs no user interaction. Any exposed YouTrack web console is a potential target.
• AC:L — no special conditions, race conditions, or timing windows are required; the flaw is trivially reachable over the standard HTTPS port.
• C:H — database backups contain the full contents of the YouTrack data store: user accounts, password hashes, API tokens, issue/comment content, attachments metadata, project configurations, and any credentials stored for third-party integrations.
• I:H — the attack also scores high integrity impact; an attacker with a full database dump can use extracted credentials to log in and modify issues, delete data, or pivot into connected systems, and may be able to tamper with backup integrity before restoration.
• A:N — the vulnerability does not directly affect availability.

No public PoC, Nuclei template, or exploit code is currently tracked, and FIRST.org has not yet assigned an EPSS score. The description is intentionally sparse; no specific endpoint, parameter name, or file path is provided in the NVD data, so detection must rely on behavioral and class-level indicators rather than exact signatures.

Exploitation Scenarios

Because no public exploit code exists, the attack chain below is inferred from the vulnerability class (authentication bypass via alternate path) and the NVD description. No specific implementation details beyond the description are assumed.

1. Reconnaissance / target identification. The attacker locates internet-exposed YouTrack instances using search engines or Shodan queries (e.g., title or HTML markers containing "YouTrack"). Given AV:N and PR:N, any reachable instance is a candidate. The attacker fingerprints the build to determine whether it falls before the fixed builds (2025.3.156085, 2026.1.13913, 2026.2.18112).

2. Triggering the flaw. The attacker interacts with the YouTrack HTTP interface to obtain or replay a shared draft signature. The class-level mechanism is an alternate-path bypass: the server is presented with a request that carries a draft-sharing signature but points to a backup artifact. Because the signature's scope is not validated against the requested resource, the request is authorized incorrectly. No session cookie or credentials are needed.

3. Payload / execution. At the vulnerability-class level, this is a crafted HTTP request (or series of requests) that reuses a shared draft signature to reach a backup-download flow. The server responds with the database backup payload — typically a compressed SQL or archive representation of the YouTrack database. The attacker does not need to inject content; the "payload" is simply the unauthorized retrieval of an existing sensitive object.

4. Post-exploitation impact. The attacker exfiltrates the backup and extracts credentials, tokens, and sensitive project data. Harvested account credentials enable authenticated access to YouTrack and possibly to connected services (e.g., if users reused passwords). Because integrity impact is rated high, the attacker may alter issues, insert backdoors into project content, or manipulate data before an administrator notices. The integrity score may also reflect the risk that an attacker could use recovered signing material or database contents to forge further valid requests within the same deployment.

No public PoC is available, so the precise request pattern cannot be enumerated. Defenders should treat this as a critical, remotely exploitable data-exfiltration and credential-theft risk.

Impact Assessment

CVE-2026-75045 carries a CVSS base score of 9.1 (Critical) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. The high confidentiality subscore is the dominant driver: a full database backup exposes every user record, password hash, API token, issue, comment, and integration credential stored by YouTrack. The high integrity subscore reflects the realistic downstream chain — stolen credentials permit authenticated changes to the tracker and connected systems, and the attacker can potentially manipulate or restore tampered backup data.

The blast radius includes every organization running an affected, internet-facing (or broadly reachable) YouTrack instance. Affected systems are unpatched builds prior to the listed fixed versions on the 2025.3, 2026.1, and 2026.2 release lines. Business impacts are severe: regulatory notification obligations under GDPR/CCPA if personal data is exfiltrated, loss of proprietary development data, credential and session-token compromise, and reputational damage from a public critical disclosure. The vendor is JetBrains; the fixed builds are named in the NVD description, but the tracked patch sources (0/4 confidence) have not yet confirmed an official advisory, so upgrade planning should be verified directly with JetBrains.

As of writing, CVE-2026-75045 is NOT listed in CISA's Known Exploited Vulnerabilities catalog, and no in-the-wild exploitation or threat-actor campaigns have been publicly documented. EPSS scoring is unavailable, so prioritization should be driven by asset exposure and the criticality of the data store.

Detection Guidance

Note: because no specific endpoint or file path is published, the following rules detect the observable consequence of exploitation — the download of database backup artifacts from YouTrack hosts — rather than a unique exploit signature. Tune the match lists to your environment.

Sigma Rule

title: JetBrains YouTrack Potential Database Backup Download (CVE-2026-75045)
status: experimental
description: Detects HTTP 200 responses for backup-like file extensions from JetBrains YouTrack hosts, consistent with unauthenticated database backup download (CWE-288 authentication bypass).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-75045
logsource:
    category: webserver
    product: generic
detection:
    selection_host:
        cs-host|contains: youtrack
    selection_backup:
        sc-status: 200
        cs-uri-extension|contains:
            - .backup
            - .bak
            - .dump
            - .sql
            - .zip
            - .gz
    condition: selection_host and selection_backup
falsepositives:
    - Legitimate administrative backup downloads by authorized operators
level: high
tags:
    - attack.t1190
    - attack.collection
    - cve.2026-75045
    - cwe.288

YARA Rule

rule YouTrack_DB_Backup_Exfil_CVE_2026_75045
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects JetBrains YouTrack database backup content, an exfiltration artifact for CVE-2026-75045"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75045"
        cve = "CVE-2026-75045"
    strings:
        $gzip_magic = { 1F 8B }
        $zip_magic  = { 50 4B 03 04 }
        $pg_dump    = "PostgreSQL database dump"
        $mysql_dump = "MySQL dump"
        $sql_create = "CREATE TABLE"
        $sql_insert = "INSERT INTO"
        $yt_marker  = "YouTrack"
        $jb_marker  = "JetBrains"
    condition:
        (uint16(0) == 0x8B1F or uint32(0) == 0x04034B50) and
        ($yt_marker or $jb_marker) and
        2 of ($pg_dump, $mysql_dump, $sql_create, $sql_insert)
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-75045 JetBrains YouTrack Potential Database Backup Exfiltration"; flow:established,to_client; http.host; content:"youtrack"; nocase; http.response_body; content:"PostgreSQL database dump"; nocase; classtype:attempted-download; sid:202675045; rev:1; metadata:created_at 2026_01_01, cve CVE-2026-75045;)

This rule fires when a YouTrack host returns a response body containing PostgreSQL dump markers — the expected content of a YouTrack database backup. Adjust the SQL marker to match your database engine if YouTrack is deployed with MySQL.

Elastic Detection

any where event.category == "http" and http.response.status_code == 200
  and host.name like "*youtrack*"
  and (url.path like "*.backup" or url.path like "*.bak" or url.path like "*.dump"
       or url.path like "*.sql" or url.path like "*.zip" or url.path like "*.gz")
  and not source.ip in ("127.0.0.1", "::1")

The query flags HTTP 200 responses from YouTrack hosts for archive/database file paths. Add an additional correlation on high response bytes values if your ingest pipeline records them, to filter out small 404-style responses.

Splunk SPL Query

index=web sourcetype=access_combined status=200 host=*youtrack*
| where match(uri_path, "(?i)\.(backup|bak|dump|sql|zip|gz)$")
| eval threat="CVE-2026-75045"
| stats count earliest(_time) latest(_time) min(bytes) max(bytes) sum(bytes) by src_ip, host, uri_path, status, threat
| sort - sum(bytes)

Run this against reverse-proxy or web-server access logs covering YouTrack. A single source IP receiving multiple large backup-type responses in a short window is a strong indicator of exploitation or unauthorized backup staging.

Wazuh OSSEC Rule

<group name="web,accesslog,youtrack,">
    <rule id="100402" level="12">
        <decoded_as>web</decoded_as>
        <field name="url">\.(backup|bak|dump|sql|zip|gz)$</field>
        <field name="status">200</field>
        <description>CVE-2026-75045: possible JetBrains YouTrack database backup download attempt</description>
        <group>youtrack,cve_2026_75045,exfiltration,</group>
    </rule>
</group>

Place the rule in a local Wazuh ruleset file and verify that the web decoder populates the url and status fields for your access-log format. The rule triggers when a YouTrack URL ending in a backup/archive extension returns HTTP 200, with a severity of 12.

Mitigation & Patch Guidance

Patch confidence is 0/4 — no patch evidence from any tracked source. The NVD description names fixed builds (2025.3.156085, 2026.1.13913, 2026.2.18112), but the vendor advisory has not been confirmed by the tracked patch sources. Treat upgrade information with caution and verify directly with JetBrains.

1. Immediate mitigations. Restrict network access to the YouTrack console: place it behind a VPN or an authenticated reverse proxy, and block direct internet exposure at the firewall. Apply WAF rules to block backup/archive URI patterns (.backup, .bak, .dump, .sql, .zip, .gz) and to alert on large outbound transfers from YouTrack hosts. Disable or restrict the backup-download feature if your deployment exposes a configuration toggle. Rotate any credentials that may already have been exposed if suspicious access was observed.

2. Patch/upgrade steps. Confirm the fixed builds with JetBrains support and JetBrains' official YouTrack changelog. Upgrade affected instances to at least 2025.3.156085 (2025.3 line), 2026.1.13913 (2026.1 line), or 2026.2.18112 (2026.2 line) as applicable to your release track. Prior to upgrading, take a verified offline backup of the current instance and test the upgrade in a staging environment. After the upgrade, rotate all user tokens and integration credentials, because even a successful upgrade does not invalidate data already exfiltrated.

3. Long-term hardening. Apply CWE-288 guidance by design: ensure every alternate resource path enforces authentication and checks authorization scope against the capability token presented. Maintain YouTrack on the latest release line and subscribe to JetBrains security advisories. Monitor CISA KEV and FIRST.org EPSS feeds for CVE-2026-75045 — this CVE is not yet listed in KEV, but the risk profile (unauthenticated full database disclosure) warrants follow-up. Regularly audit access logs for backup-download patterns and restrict administrative backup functions to dedicated, network-isolated admin hosts.

References

• NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-75045
• CWE-288 (Authentication Bypass Using an Alternate Path): https://cwe.mitre.org/data/definitions/288.html
• JetBrains YouTrack Changelog / Product Site: https://www.jetbrains.com/youtrack/whatsnew/
• CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-75045 is NOT listed at the time of writing)

At the time of this report, no vendor advisory URL, researcher blog, threat-actor campaign, or in-the-wild exploit evidence has been publicly documented for CVE-2026-75045. EPSS scoring is not yet available from FIRST.org.