CVE-2026-75055

Executive Summary

CVE-2026-75055 is an XML External Entity (XXE) vulnerability, classified as CWE-611, in the Hadoop ResourceManager integration of JetBrains IntelliJ IDEA, affecting all versions prior to 2026.2.1. A local attacker who can trick a developer into opening or loading a crafted XML document through this component can cause the IDE to read arbitrary local files that are readable by the user running IntelliJ IDEA. No public exploit, CISA KEV listing, or vendor patch advisory has been tracked to date, although the version boundary in the description indicates a fix is expected at version 2026.2.1.

Technical Analysis

The NVD description for CVE-2026-75055 is sparse, stating only: "In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE." No CNA title, affected version list, OSV package data, or vendor advisory has been published in the provided intelligence data. The following analysis is therefore derived from the vulnerability class and the available description rather than from patch-level or source-code details.

The vulnerability resides in an XML parsing path used by IntelliJ IDEA when interacting with the Hadoop ResourceManager. Hadoop ResourceManager is a component of the Hadoop ecosystem that tracks and allocates resources across a cluster; in an IDE context, this integration typically parses XML payloads such as cluster configurations, service responses, or job-resource descriptors. The flaw is an XXE condition: the XML parser used for this handling does not disable external entity resolution. When the parser encounters a document containing a DOCTYPE declaration with an external SYSTEM entity, it resolves the entity URI and substitutes the retrieved content into the document tree.

Because XXE resolution is performed with the privileges of the IntelliJ IDEA process — i.e., the privileges of the logged-in developer — the entity URI can reference local file paths via file:// URIs, allowing the attacker to read any file accessible to the user. This includes project source code, SSH private keys, cloud credentials, environment variables, shell histories, and configuration files. The parsed result may be disclosed to the attacker through the IDE interface, error messages, log output, or subsequent network interaction, depending on how the parsed XML content is rendered by the ResourceManager component.

The CVSS vector, CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, is consistent with this analysis: a local attack vector (AV:L), low attack complexity (AC:L), no privileges required (PR:N) but user interaction required (UI:R), a single-system scope (S:U), and a high confidentiality impact (C:H) with no integrity or availability impact (I:N/A:N). The requirement for user interaction indicates that the attacker must persuade the user to open a malicious XML document or connect to a malicious ResourceManager endpoint — the vulnerability cannot be triggered purely by network access without user action.

It must be noted that insufficient technical detail is available from the NVD entry to name the exact parser class, XML surface (e.g., configuration import, connection wizard, or REST response handling), or any function names, endpoints, or file paths within IntelliJ IDEA. No code-level specifics should be inferred beyond the general XXE mechanism and the reference to the Hadoop ResourceManager integration.

Exploitation Scenarios

No public PoC is available for CVE-2026-75055, and the exploit chain below is inferred from the vulnerability class (XXE) and the CVSS metadata. Attackers would target developers and engineers whose workstations run vulnerable IntelliJ IDEA builds with the Hadoop integration enabled.

Step 1 — Reconnaissance and target identification. The target is a developer workstation running IntelliJ IDEA prior to 2026.2.1. An attacker could identify such targets through supply-chain means, such as hosting a malicious or trojanized open-source project that the developer clones and opens in the IDE, or by sending a crafted project/configuration file directly (e.g., via email, chat, or a file-sharing platform). Because the attack vector is local (AV:L), physical or remote access to the machine is not strictly required; delivering a malicious file to the victim is sufficient, leveraging user interaction (UI:R).

Step 2 — Triggering the flaw. The attacker crafts an XML document designed for the Hadoop ResourceManager integration. When the developer opens this file in the IDE — for example, importing a Hadoop cluster configuration or establishing a connection to a ResourceManager endpoint that returns the malicious XML — the vulnerable parser processes the document. No authentication or special privileges are required on the part of the attacker (PR:N); the only precondition is that the victim opens the file or navigates the IDE to the malicious content.

Step 3 — Payload and execution mechanism. At the vulnerability-class level, the payload takes the form of an XML external entity declaration, such as a DOCTYPE with an ENTITY whose system identifier is a file:// URI pointing to a local file (for example, a credentials file or private key). During parsing, the entity reference is expanded, and the contents of the referenced local file are read into the XML document by the parser. The attacker then observes the file contents through whatever output channel the IDE provides for the parsed document — commonly the ResourceManager view, error diagnostic output, or application logs.

Step 4 — Post-exploitation impact. The attacker harvests the disclosed file contents, which may include source code, API keys, cloud access tokens, or SSH private keys. These credentials can then be reused to move laterally into corporate infrastructure, code repositories, or cloud environments. Because the disclosure mechanism is restricted to the developer's local machine, exfiltration may require a secondary channel (e.g., a network callback embedded in a permitted entity resolution, or manual observation of the output). The confidentiality impact is the primary consequence; no integrity or availability impact is indicated by the CVSS score.

Impact Assessment

The business impact of CVE-2026-75055 is centered on confidentiality, with a high confidentiality subscore (C:H) and no integrity or availability impact, consistent with CVSS 3.1 base score of 5.5. Developer workstations are high-value targets because they hold source code, hardcoded secrets, SSH keys, cloud provider credentials, and corporate VPN tokens. Successful exploitation of an XXE condition in this context allows a local attacker, or a remote attacker who socially engineers the victim, to read these files.

The blast radius is technically limited to the single host running IntelliJ IDEA (scope: Unchanged), but the practical downstream impact can be substantial: exfiltrated credentials and proprietary source code may enable broader compromise of development pipelines, CI/CD systems, and cloud environments. Because the affected product is a widely used IDE, a large population of developers and enterprises is theoretically exposed; however, the local attack vector and required user interaction significantly reduce the likelihood of mass exploitation. EPSS has not yet assigned a score, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog, indicating no confirmed in-the-wild exploitation as of the reporting date.

Detection Guidance

Detection for CVE-2026-75055 is inherently difficult because the vulnerable behavior occurs inside a Java process (IDE) that legitimately reads many files. The rules below focus on two signals: (1) suspicious XML content containing DOCTYPE/SYSTEM/file:// constructs consistent with XXE payloads, and (2) the IntelliJ IDEA process accessing highly sensitive local files (e.g., credential stores, SSH keys, and password databases). Analysts should tune baseline false positives to the individual environment.

Sigma Rule

title: JetBrains IntelliJ IDEA XXE Local File Read Attempt (CVE-2026-75055)
id: 6b3f4a9c-1d2e-4f8a-9b7c-3a5f6c7d8e90
status: experimental
description: Detects file-create or file-write events where a JetBrains IntelliJ IDEA process (Java) creates or accesses files commonly targeted by XXE local file disclosure, such as passwd files, SSH keys, and credential stores. Correlate with XML content if available.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-75055
author: Valters IT Threat Intelligence
date: 2026/02/01
logsource:
    product: windows
    service: sysmon
detection:
    selection_process:
        EventID: 11
        Image|endswith:
            - '\java.exe'
            - '\idea64.exe'
    selection_targets:
        TargetFilename|contains:
            - '\passwd'
            - '\.ssh\'
            - '\id_rsa'
            - '\id_dsa'
            - '\known_hosts'
            - '\credentials'
            - '\AppData\Local\'
            - '\bash_history'
            - '\config\'
    condition: selection_process and selection_targets
falsepositives:
    - Legitimate IDE indexing or inspection of user files and directories
    - Developers intentionally opening configuration files in the IDE
level: high

YARA Rule

rule CVE_2026_75055_XXE_Hadoop_ResourceManager
{
    meta:
        description = "Detects XML documents containing external entity declarations with file:// SYSTEM identifiers, indicative of XXE payloads targeting CVE-2026-75055 in JetBrains IntelliJ IDEA Hadoop ResourceManager."
        author = "Valters IT Threat Intelligence"
        date = "2026-02-01"
        cve = "CVE-2026-75055"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75055"
    strings:
        $doc_type = /<!DOCTYPE[\x20\x09\x0d\x0a]/i
        $entity_system = /<!ENTITY[\x20\x09\x0d\x0a]+[^\x20\x09\x0d\x0a>]+[\x20\x09\x0d\x0a]+SYSTEM/i
        $file_uri = /["'][fF][iI][lL][eE]:\/\//
        $hadoop_ref = /[Rr]esource[Mm]anager/
    condition:
        $doc_type and $entity_system and $file_uri and #hadoop_ref < 3
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-75055 - XXE Payload with file:// URI in HTTP XML Body (JetBrains IntelliJ IDEA)"; flow:established,to_server; http.request_body; content:"<!DOCTYPE"; nocase; content:"SYSTEM"; nocase; distance:0; within:100; content:"file:"; nocase; distance:0; within:100; classtype:attempted-user; reference:cve,CVE-2026-75055; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-75055; sid:202675055; rev:1;)

Elastic Detection

file where process.name == "java.exe" and (
  file.name == "passwd" or
  file.name == "id_rsa" or
  file.name == "id_dsa" or
  file.name == "known_hosts" or
  file.name == ".bash_history" or
  file.name == "credentials"
) and (
  process.command_line contains "idea" or
  process.command_line contains "IntelliJ" or
  process.command_line contains "com.intellij"
)

Splunk SPL Query

index=win* source="*Sysmon*" EventCode=11
  (Image="*java.exe" OR Image="*idea64.exe")
  (TargetFilename="*passwd*" OR TargetFilename="*.ssh*" OR TargetFilename="*id_rsa*" OR TargetFilename="*id_dsa*" OR TargetFilename="*credentials*" OR TargetFilename="*.bash_history*")
| stats count min(_time) as first_seen max(_time) as last_seen by host, Image, TargetFilename, User
| sort - count

Wazuh OSSEC Rule

<group name="audit,">
  <rule id="100755" level="10">
    <if_sid>80700</if_sid>
    <field name="audit.file.name">passwd</field>
    <description>CVE-2026-75055: JetBrains IntelliJ IDEA process read attempt on local autentication file (possible XXE local file disclosure).</description>
    <group>local_file_read,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Current patch confidence is 0/4 — no patch evidence has been identified from any tracked source, and no vendor fix or workaround has been formally published. The NVD description states the vulnerability exists "before 2026.2.1," which implies that upgrading to IntelliJ IDEA 2026.2.1 or later addresses the flaw, but this cannot be independently confirmed from the available data.

1) Immediate mitigations:

• Disable or remove the Hadoop ResourceManager integration/plugin in IntelliJ IDEA where it is not operationally required.
• Instruct developers not to open XML documents, project archives, or cluster configuration files from untrusted sources, and not to connect the ResourceManager integration to untrusted endpoints.
• Restrict access to developer workstations and enforce strong authentication to reduce the ability of a local attacker to deliver a malicious file.
• Monitor developer workstations for unsolicited incoming files and for the IDE process accessing sensitive files (using the detection rules above).

2) Patch/upgrade steps:

• Upgrade IntelliJ IDEA to version 2026.2.1 or later as soon as a build becomes available from JetBrains.
• Verify the vendor's official security advisory for CVE-2026-75055 before deploying the upgrade in enterprise environments, and validate that the Hadoop ResourceManager XML handling no longer resolves external entities.

3) Long-term hardening:

• Implement a formal patch-management cadence for development tools, treating IDEs and their plugins as security-relevant software.
• Apply the principle of least privilege on developer workstations, including separate accounts for development and administrative tasks, and enable full-disk encryption to mitigate local confidentiality risks.
• Consider network-level controls (e.g., egress filtering, web application firewalls) to detect XXE payloads in transit, as demonstrated by the Suricata rule above.
• Where possible, run development tooling in sandboxed or virtualized environments when handling untrusted projects.
• Track the vulnerability through the referenced sources below until an official JetBrains advisory and patch are confirmed.

References

1. NVD Entry — CVE-2026-75055: https://nvd.nist.gov/vuln/detail/CVE-2026-75055
2. MITRE CWE-611 — Improper Restriction of XML External Entity Reference: https://cwe.mitre.org/data/definitions/611.html
3. JetBrains Security Bulletins and Advisories: https://www.jetbrains.com/security/
4. JetBrains IntelliJ IDEA Product and Release Notes: https://www.jetbrains.com/idea/
5. MITRE ATT&CK Technique T1005 — Data from Local System: https://attack.mitre.org/techniques/T1005/

At the time of writing, no known threat-actor campaigns, exploit-in-the-wild evidence, or CISA KEV listing are associated with CVE-2026-75055. Network and endpoint indicators specific to this CVE have not been publicly released; analysts should treat the detection rules in this report as generic XXE/local-file-read heuristics to be tuned against baseline behavior.