CVE-2026-75053

Executive Summary

CVE-2026-75053 is a server-side request forgery (SSRF) vulnerability in JetBrains IntelliJ IDEA versions prior to 2026.2.1, reachable through the DevKit debug listener endpoint. An attacker who can elicit user interaction can cause the IDE process to issue arbitrary HTTP requests to internal network services and cloud metadata endpoints, with low confidentiality and low integrity impact. No public proof-of-concept, vendor advisory, or CISA KEV listing exists as of this report, and patch status is unverified (0/4 confidence).

Technical Analysis

The NVD description states that in JetBrains IntelliJ IDEA before 2026.2.1, "sSRF" (i.e., SSRF) was possible via the DevKit debug listener endpoint. The DevKit is the plugin development kit component of the IDE, and the debug listener is an endpoint used during plugin debugging sessions. The vulnerability is classified under CWE-918 (Server-Side Request Forgery).

In an SSRF of this class, an attacker-controlled input is passed to a server-side HTTP client without sufficient validation of the destination host, IP, or protocol. In this case, the vulnerable component is the DevKit debug listener running inside the IDE process. This is significant because the request is executed with the privileges and network position of the logged-in developer, not with the limited privileges of a typical sandboxed web service. IDE processes routinely have unrestricted outbound access to internal networks, source control systems, package registries, and cloud metadata endpoints.

The NVD description does not disclose the listener's wire protocol, URI scheme, parameter names, or binding behavior (loopback vs. all interfaces). Consequently, precise technical implementation details are not available. At the vulnerability-class level, the listener fails to validate a target URL or host supplied in a client request, then performs a fetch on behalf of the attacker.

Key CVSS characteristics derived from the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N:

• Attack Vector: Network — remotely exploitable.
• Attack Complexity: Low — no special conditions or race conditions required.
• Privileges Required: None — no authentication needed to trigger.
• User Interaction: Required — a victim developer must perform an action (e.g., open a crafted project, link, or configuration file).
• Scope: Unchanged.
• Impact: Low confidentiality (limited information disclosure), Low integrity (limited modification of internal resources), No availability impact.

The affected attack surface is developer workstations running vulnerable IntelliJ IDEA builds, especially environments that use the DevKit plugin for plugin development, and any internal services reachable from those workstations. Insufficient technical detail is available in the public record to confirm whether the debug listener is bound to loopback or network interfaces; this materially affects remote exploitability.

Exploitation Scenarios

No public proof-of-concept, Nuclei template, or exploit code has been identified. The attack chain below is inferred strictly from the vulnerability class (CWE-918), the CVSS vector, and the NVD description. It should be used for detection engineering and risk assessment, not as a step-by-step exploitation guide.

1. Reconnaissance / Target Identification: An attacker identifies developers running IntelliJ IDEA builds older than 2026.2.1. This can be done via network scanning for exposed IDE debug services on a corporate network, internal reconnaissance following an initial breach, or social engineering to fingerprint the IDE version. The DevKit debug listener endpoint is the intended target.

2. Triggering the Flaw: Because the CVSS vector requires user interaction (UI:R), the attacker must induce the developer to route a malicious request to the debug listener. Realistic delivery paths include opening a crafted plugin project, clicking a malicious URL handled by the IDE, or importing a configuration file that the listener processes. The crafted input causes the listener to treat an attacker-controlled URL or host as a legitimate fetch target.

3. Payload / Execution at the Vulnerability-Class Level: The request causes the IDE to issue an HTTP (or other supported protocol) request to an arbitrary destination chosen by the attacker. Common SSRF targets of this class include:

   • Cloud metadata endpoints: 169.254.169.254 (AWS), 169.254.170.2 / 169.254.170.23 (AWS ECS/EC2), 100.100.100.200 (Alibaba Cloud).
   • Internal administrative panels, Kubernetes API servers, or CI/CD infrastructure.
   • Internal source control or artifact repositories for limited integrity modification.

4. Post-Exploitation Impact: Successful exploitation yields low confidentiality and low integrity capabilities within the IDE's network scope. The attacker may read cloud credentials or internal service data, and may perform limited modifications on internal resources. From the compromised IDE process, the attacker can pivot laterally using the developer's credentials and network position. The scope remains unchanged (S:U), meaning the compromise does not directly cross trust boundaries beyond the IDE's existing access.

Impact Assessment

CVE-2026-75053 carries a CVSS 3.1 base score of 5.4 (Medium). Breaking out the vector: AV:N (remotely accessible), AC:L (no special conditions), PR:N (no authentication), UI:R (victim interaction required), S:U (scope unchanged), C:L (limited confidentiality loss), I:L (limited integrity loss), A:N (no availability loss).

Business impact: Developer workstations are high-value targets in software supply chain and lateral-movement campaigns. Successful SSRF exploitation can expose cloud credentials and internal service topologies, and can enable limited internal modification. However, the low confidentiality and integrity ratings indicate a single exploitation yields only bounded data access and modification, with no availability impact. The blast radius is the developer's workstation and any internal systems reachable from it, including cloud metadata, source control, package registries, and internal tooling.

Because patch confidence is 0/4 (no tracked patch evidence), the residual risk is elevated in organizations where vulnerable IntelliJ IDEA builds are widely deployed. The absence of a CISA KEV listing and the lack of public PoC reduce immediate exploit-in-the-wild likelihood, but SSRF flaws in developer tooling are attractive targets once weaponized.

Detection Guidance

The NVD description does not disclose the exact debug listener endpoint, protocol, or parameter names. Detection rules therefore focus on observable SSRF behavior: anomalous outbound connections from IDE (Java) processes to internal IP ranges and cloud metadata endpoints. Analysts should tune these rules against baseline IDE traffic to minimize false positives.

Sigma Rule

title: JetBrains IntelliJ IDEA DevKit Debug Listener SSRF Attempt
id: 3b7c8a1e-27fe-4b2c-9a44-6f6c8d3e5a20
status: experimental
description: >
  Detects outbound network connections from JetBrains IntelliJ IDEA (java.exe)
  processes to cloud metadata endpoints and internal IP ranges, indicative of
  SSRF exploitation of CVE-2026-75053 via the DevKit debug listener.
logsource:
  product: windows
  category: network_connection
detection:
  selection_process:
    Image|endswith: 'java.exe'
    Image|contains: 'JetBrains'
  selection_cloud_metadata:
    DestinationIp:
      - '169.254.169.254'
      - '169.254.170.2'
      - '169.254.170.23'
      - '100.100.100.200'
  selection_internal:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
    DestinationPort:
      - 80
      - 443
      - 8080
      - 8443
  condition: selection_process and (selection_cloud_metadata or selection_internal)
falsepositives:
  - Legitimate IDE connections to internal development servers or mirrors
  - Plugin update checks routed through internal proxies
level: high

YARA Rule

rule CVE_2026_75053_JetBrains_DevKit_SSRF
{
    meta:
        author = "Valters IT Threat Intelligence"
        description = "Detects SSRF payloads and DevKit debug listener artifacts associated with CVE-2026-75053 in memory captures, packet captures, or log files"
        cve = "CVE-2026-75053"
        date = "2026-04-15"
    strings:
        $s1 = "169.254.169.254" ascii wide nocase
        $s2 = "169.254.170.2" ascii wide nocase
        $s3 = "100.100.100.200" ascii wide nocase
        $s4 = "DevKit" ascii wide nocase
        $s5 = "debug listener" ascii wide nocase
        $s6 = "gopher://" ascii wide nocase
        $s7 = "file://" ascii wide nocase
        $s8 = "IntelliJ IDEA" ascii wide nocase
    condition:
        filesize < 5MB and
        (
            (2 of ($s1, $s2, $s3)) or
            (1 of ($s6, $s7))
        ) and
        (1 of ($s4, $s5, $s8))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-75053 JetBrains IntelliJ IDEA DevKit SSRF - request to cloud metadata address"; flow:established,to_server; content:"169.254.169.254"; http.uri; content:"169.254.170.2"; http.uri; content:"100.100.100.200"; http.uri; classtype:attempted-recon; sid:20267505301; rev:1;)

alert http any any -> any any (msg:"CVE-2026-75053 JetBrains DevKit SSRF - loopback target in URI"; flow:established,to_server; content:"http://127.0.0.1"; http.uri; content:"http://localhost"; http.uri; classtype:attempted-recon; sid:20267505302; rev:1;)

Elastic Detection

network where process.name == "java.exe" and network.direction == "egress" and (
  destination.ip in ("169.254.169.254", "169.254.170.2", "169.254.170.23", "100.100.100.200") or
  cidrMatch(destination.ip, "10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
) and network.protocol == "http"

Splunk SPL Query

index=windows sourcetype=WinEventLog:Microsoft-Windows-Sysmon/Operational EventCode=3
| search Image=*java.exe* JetBrains
| where dest_ip IN ("169.254.169.254","169.254.170.2","169.254.170.23","100.100.100.200")
   OR cidrmatch("10.0.0.0/8", dest_ip)
   OR cidrmatch("172.16.0.0/12", dest_ip)
   OR cidrmatch("192.168.0.0/16", dest_ip)
| eval ssrf_indicator = case(
     dest_ip IN ("169.254.169.254","169.254.170.2","169.254.170.23","100.100.100.200"), "cloud-metadata",
     true(), "internal-network")
| stats count earliest(_time) latest(_time) by user, host, Image, SourceIp, dest_ip, dest_port, ssrf_indicator
| sort - _time

Wazuh OSSEC Rule

<group name="jetbrains,cve-2026-75053,ssrf,">
  <rule id="100753" level="10">
    <field name="win.eventdata.image" type="pcre2">(?i)java\.exe</field>
    <field name="win.eventdata.destinationIP" type="pcre2">^(169\.254\.169\.254|169\.254\.170\.2|169\.254\.170\.23|100\.100\.100\.200)$</field>
    <description>CVE-2026-75053: Potential SSRF by JetBrains IntelliJ IDEA process to cloud metadata endpoint</description>
    <group>ssrf,jetbrains,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4 — no patch evidence exists from any tracked source. The NVD description implies the defect exists "before 2026.2.1," suggesting the 2026.2.1 release line addresses it, but no vendor advisory, changelog entry, or CVE bulletin has been independently verified. Organizations should treat this CVE as unpatched until JetBrains publishes confirmation.

1. Immediate Mitigations:

   • Disable the DevKit debug listener or DevKit plugin when not actively developing plugins.
   • Deploy host-based firewall rules restricting inbound connections to IDE debug/development ports to loopback only.
   • Implement egress filtering that blocks outbound requests from IDE processes to cloud metadata endpoints (169.254.169.254, 169.254.170.2, 169.254.170.23, 100.100.100.200) and, where feasible, to internal RFC1918 ranges.
   • Harden cloud environments with IMDSv2 and metadata service access restrictions to limit SSRF impact.
   • Treat untrusted IDE inputs (projects, links, configuration files) as an attack vector; prevent developers from opening untrusted content on sensitive workstations.
   • Monitor developer workstation egress traffic for anomalous outbound connection patterns.

2. Patch / Upgrade Steps:

   • Check the JetBrains IntelliJ IDEA release notes for build 2026.2.1 and plan an upgrade once the fix is confirmed for your exact edition (Community/Ultimate).
   • Do not assume the issue is resolved without verifying the installed build and JetBrains' advisory.
   • Re-evaluate patch confidence as new vendor evidence becomes available.

3. Long-Term Hardening:

   • Segment development networks from production; restrict IDE reachability to internal services using ACLs.
   • Deploy EDR with behavioral detection for SSRF-like egress patterns from IDE processes, using the detection rules above.
   • Integrate the provided Sigma/Suricata/Elastic/Splunk/Wazuh rules into SIEM and SOAR workflows, tuning against baseline IDE traffic.
   • Maintain subscriptions to JetBrains security notifications and the NVD feed to receive the advisory when published.

References

• NVD entry: https://nvd.nist.gov/vuln/detail/CVE-2026-75053
• CWE-918 Server-Side Request Forgery: https://cwe.mitre.org/data/definitions/918.html
• MITRE ATT&CK Technique T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• JetBrains Security Portal (for future vendor advisory): https://www.jetbrains.com/security/
• CISA KEV: CVE-2026-75053 is NOT listed. No exploit-in-the-wild evidence or known threat actor campaigns are tracked as of this report.