CVE-2026-75057

Executive Summary

CVE-2026-75057 is a local information-disclosure vulnerability in JetBrains IntelliJ IDEA releases prior to 2026.1.5. During normal git operations, the IDE writes git credentials to the IDE log file in plaintext, violating the expected redaction of secrets. Any local user or process able to read the IDE log can recover the affected credentials, enabling unauthorized access to git repositories. The weakness is classified as CWE-532 (Insertion of Sensitive Information into Log File) and carries a CVSS v3.1 base score of 6.2 (Medium) with high confidentiality impact.

Technical Analysis

The vulnerability belongs to the CWE-532 class: an application records sensitive data in a log that is not intended for sensitive information. In this case, the NVD description explicitly states that git credentials were written in plaintext to the IntelliJ IDEA IDE log. The affected version boundary is "before 2026.1.5," which indicates that the disclosure exists across earlier release trains and that the fix is anticipated to ship in build 2026.1.5 or later.

The CVSS vector — CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N — is informative about the attack surface:

• Attack Vector (Local): The credential disclosure artifact (the log file) is only reachable by an actor with local access to the affected endpoint or to wherever the log is subsequently stored or forwarded.
• Attack Complexity (Low): No special conditions or race windows are needed; the credential recording occurs as part of normal git operations.
• Privileges Required (None): An unprivileged local user can read the IDE log if file-system permissions do not restrict it, making the elevation of confidentiality impact possible without prior privilege escalation.
• User Interaction (None): The leakage occurs automatically when a developer uses git functionality through the IDE; no victim action beyond routine usage is necessary.
• Confidentiality Impact (High): Credentials are highly sensitive. Since git credentials frequently grant read/write access to source repositories, their exposure maps directly to a high confidentiality loss. Integrity and availability are unaffected per the vector.

The NVD description is sparse: no internal class names, log file paths, or configuration parameters are provided. Code-level analysis is therefore limited to what the class of bug implies. IntelliJ IDEA authenticates to git remotes using credentials supplied interactively, stored in the IDE, or provided by the git credential helpers of the underlying operating system. When any of these authentication paths is exercised, the credential material is being emitted into a log destination in cleartext. Historically, IDEs and CLI tools that embed credentials in remote URLs (for example, https://user:token@host/repo.git) are at elevated risk of such logging because the full URL — including secrets — is passed around internally and often echoed to output streams. The absence of a public CNA advisory means the precise logging subsystem and the exact serialization format are not currently documented; the mechanism should be treated as "sensitive data in cleartext log output."

Because the affected component is an interactive desktop IDE, the vulnerable deployment surface is composed of developer workstations, contractor machines, build nodes, and any managed desktop environment where IntelliJ IDEA < 2026.1.5 is installed and where git repositories were cloned, fetched, pushed, or pulled. Logs may also be ingested by SIEMs, centralized log collectors, or support tooling, which expands the readership of the log content beyond the local user and its immediate filesystem permissions.

Exploitation Scenarios

No public proof-of-concept or exploit code exists for CVE-2026-75057 as of this writing; the following attack chain is inferred from the vulnerability class (CWE-532) and from the CVSS characteristics.

1) Reconnaissance / target identification. An attacker identifies hosts running IntelliJ IDEA prior to 2026.1.5. This can be achieved through local enumeration on a compromised machine, inventory data, or observation of IDE-specific artifacts such as workspace configuration files, recently opened project names, or running processes (idea64 / idea). The attacker also locates the IDE log file on disk or discovers that logs are being shipped to a central aggregator with broad read permissions.

2) Triggering the flaw. No special exploit payload is required to trigger the vulnerability. The flaw class activates whenever the IDE authenticates to a git remote — operations such as clone, pull, fetch, and push. If a developer authenticates with a username/password pair or with a personal access token embedded in the remote URL, the IDE records that material into its log. The attacker does not need to influence the developer; the leaking behavior is inherent to the affected software.

3) Execution / credential harvesting. The attacker reads the log file contents, either directly on the endpoint or by querying the centralized log store. Parsing for credential patterns — such as https://user:secret@host sequences, password=, or token-like strings following authentication prompts — yields usable authentication material. No code execution is required on the victim endpoint beyond the read operation; the high confidentiality impact is achieved solely through file access.

4) Post-exploitation impact. With recovered git credentials, the attacker can authenticate to the affected git hosting platforms (on-premises GitLab/GitHub Enterprise, cloud-based Git hosts, or private repositories). Depending on the token's scope, the attacker may clone proprietary code, push malicious commits, or tamper with release branches — opening the door to supply-chain compromise. If the developer reused the same password across other services, the attacker may attempt credential stuffing to expand access laterally.

Impact Assessment

The business impact is centered on credential theft and downstream source-code compromise. The CVSS subscore profile (AV:L, PR:N, UI:N, C:H) means that any unprivileged local user — including a low-privilege malware process, a shared-terminal user, a rogue contractor, or an employee with casual filesystem access — can silently harvest credentials from a developer's machine. The absence of user interaction and privilege requirements lowers the barrier to exploitation, which offsets the local-only precondition.

The blast radius includes:

• Developer workstations running IntelliJ IDEA < 2026.1.5.
• Source-code repositories reachable with the leaked credentials; the impact scales with the developer's repository access rights.
• CI/CD pipelines if the same credentials are reused in build automation or if the compromised repository is used as a build input.
• Centralized logging platforms, which, if accessible to a wider audience than the developer, multiply the exposure of the leaked secrets.

The integrity and availability scores of the vector are None, which bounds the direct technical damage to confidentiality. However, the indirect consequences of credential theft — unauthorized code modification and repository tampering — can produce serious integrity and supply-chain effects that are not reflected in the CVE's base score.

Detection Guidance

Detection for CVE-2026-75057 is best implemented as content-based monitoring of log files for embedded git credentials and for any process reading IntelliJ IDEA log artifacts. The rules below are heuristic detections for the vulnerability class and should be tuned to the local environment.

Sigma Rule

title: Git Credentials Written in Plaintext to JetBrains IntelliJ IDEA Log
id: 9f2d3b1e-4c5a-4f6d-8e9a-7b6c5d4e3f2a
status: experimental
description: Detects file modifications to JetBrains IntelliJ IDEA log files containing git credential material. Heuristic detection for CVE-2026-75057 (CWE-532).
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-75057
author: Threat Intelligence Team
date: 2026/05/15
tags:
    - attack.credential_access
    - attack.t1552
    - cve.2026.75057
    - cwe.532
logsource:
    product: windows
    category: file_event
detection:
    selection_logfile:
        TargetFilename|contains|all:
            - 'JetBrains'
            - 'IntelliJ'
            - '.log'
    selection_credentials:
        - TargetFilename|contains: 'idea'
        - Keywords|contains|all:
            - 'https://'
            - '@'
    condition: selection_logfile and selection_credentials
falsepositives:
    - Legitimate developers reading their own logs during troubleshooting
    - Log aggregation agents copying log files to central storage
level: high

Note: The Keywords field in the second selection is a placeholder for content-based matching available in some Sigma backends (e.g., Windows Event Log EventData); on backends without content search, enrich with a sourcetype that captures file writes or use the Sysmon FileCreate/FileWrite event's content hash correlation.

YARA Rule

rule CVE_2026_75057_IntelliJ_Git_Creds_Plaintext
{
    meta:
        author = "Valters IT Threat Intelligence"
        date = "2026-05-15"
        description = "Detects plaintext git credentials appearing in JetBrains IntelliJ IDEA log content"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-75057"
        cve = "CVE-2026-75057"
        cwe = "CWE-532"
        score = 62
    strings:
        $idea = "IntelliJ IDEA" nocase
        $git_verb = /(clone|push|pull|fetch|commit|branch)/ nocase
        $url_creds = /https?:\/\/[^\s\/]+:[^\s\/@]+@[a-zA-Z0-9.\-]+\.[a-zA-Z]{2,}/ nocase
        $pwd_kv = /(password|passwd|pwd|access_token|token)\s*[=:]\s*[^\s\r\n]+/ nocase
        $auth_basic = /Basic [A-Za-z0-9+\/]+=*/ 
    condition:
        $idea and $git_verb and 1 of ($url_creds, $pwd_kv, $auth_basic)
}

Suricata IDS Rule

The vulnerability manifests on the local filesystem; network detection targets the downstream exfiltration or forwarding of the leaked credentials (e.g., log shipping, HTTP exfiltration, or credential reuse against git hosts).

alert http any any -> any any (msg:"CVE-2026-75057 - Plaintext git credential material in HTTP traffic (heuristic)"; flow:to_server,established; content:"git"; http.uri; pcre:"/https?:\/\/[^:\s\/]+:[^@\s]+\@/Ui"; metadata:cvss_base_score 6.2; reference:cve,2026-75057; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2026-75057; classtype:attempted-user; sid:202675057; rev:1;)

Elastic Detection

// Detect writes to JetBrains IntelliJ IDEA log files that contain credential-like content
file where event.action in ("modification", "creation")
    and file.name : "*idea*.log"
    and process.name : ("java*", "idea*")
    and (file.text : "*https://*:*@*"
         or file.text : "*password=*"
         or file.text : "*access_token=*")

Splunk SPL Query

index=* (sourcetype="WinEventLog:Security" OR sourcetype="xmlwineventlog" OR sourcetype="linux_audit")
  [search index=* source="*JetBrains*" OR source="*idea*.log" OR sourcetype="*intellij*"
    | eval cred_match = if(match(_raw, "https?://[^\s]+:[^\s@]+@"), "url_creds",
                        if(match(_raw, "(?i)(password|passwd|token)\s*[=:]\s*\S+"), "kv_creds", "none"))
    | where cred_match != "none"
    | stats count by host, source]
| table _time, host, source, user, _raw
| sort - _time

This query first identifies hosts whose IntelliJ IDEA logs contain credential-like strings, then pulls the surrounding authentication and process events for those hosts. Adjust source and sourcetype filters to match the local log-collection layout.

Wazuh OSSEC Rule

<group name="jetbrains,intellij,credential_access,">
  <rule id="100750" level="12">
    <decoded>
    <match>IntelliJ IDEA|JetBrains</match>
    <regex>https?://\S+:\S+@\S+</regex>
    <description>CVE-2026-75057: possible plaintext git credentials detected in JetBrains IntelliJ IDEA log</description>
    <group>credential_access,cwe532,</group>
    <mitre>
      <id>T1552</id>
    </mitre>
    <options>no_full_log</options>
  </rule>
</group>

The rule triggers on decoded log events that reference IntelliJ IDEA or JetBrains and contain URL-embedded credential patterns. A level of 12 marks a high-severity credential-access alert; tune the level down (e.g., 7) if false positives from routine debugging output prove excessive.

Mitigation & Patch Guidance

Patch confidence is 0/4 — UNPATCHED. No patch evidence has been indexed from any tracked source, and no vendor advisory URL is publicly available. The NVD description indicates the flaw affects versions before 2026.1.5, which strongly implies that 2026.1.5 (or later) is the first fixed release, but this should be verified directly with JetBrains before treating it as a completed remediation.

1) Immediate mitigations:

• Restrict read permissions on JetBrains IntelliJ IDEA log directories to the owning developer account. Remove world-readable and group-readable ACEs, on both the local filesystem and any synchronized/backed-up copies.
• Audit existing IDE logs for credential strings. Search for https:// sequences containing @ and for password= / token= key-value pairs. Treat any found material as compromised.
• Rotate all git credentials, tokens, and passwords that may have been written to logs. For hosted git platforms, revoke and regenerate personal access tokens, and audit token usage history for anomalous access.
• Instruct developers to remove credentials from git remote URLs and use credential helpers (Git Credential Manager, operating-system keychain, or SSH key authentication) so secrets never appear in a form that can be logged.

2) Patch/upgrade steps:

• Monitor JetBrains IntelliJ IDEA release notes and the vendor issue tracker for the official fix for CVE-2026-75057.
• Upgrade IntelliJ IDEA to version 2026.1.5 or later as soon as the build is verified by the vendor. Coordinate with software-asset-management to inventory all instances below the fixed version.
• After upgrading, re-run the log audit to confirm that no new credential material is being written to logs.

3) Long-term hardening:

• Deploy secrets-management tooling (e.g., enterprise secrets scanning in CI, pre-commit hooks) to detect credentials in logs and source files automatically.
• Centralize log generation with redaction policies so that sensitive fields are masked before log shipping.
• Apply the principle of least privilege to log stores; developers' local logs should not be broadly accessible within the enterprise, and SIEM ingestion pipelines should strip or encrypt credential-like fields.
• Include CWE-532 in secure-coding guidelines for internal tools, and require log-review checkpoints during development to prevent recurrence of plaintext-secret logging.

References

1. NVD Entry — CVE-2026-75057: https://nvd.nist.gov/vuln/detail/CVE-2026-75057
2. MITRE CWE-532 — Insertion of Sensitive Information into Log File: https://cwe.mitre.org/data/definitions/532.html
3. MITRE ATT&CK — T1552, Unsecured Credentials: https://attack.mitre.org/techniques/T1552/
4. JetBrains IntelliJ IDEA (vendor product page / release notes): https://www.jetbrains.com/idea/
5. CISA Known Exploited Vulnerabilities catalog — CVE-2026-75057 is NOT listed (no KEV entry as of this report)

Threat-actor campaigns / in-the-wild evidence: No exploit code, public PoC, or active exploitation campaigns referencing CVE-2026-75057 were identified at the time of this report. The vulnerability is a low-complexity local information disclosure that may nevertheless be chained with other local intrusion techniques to harvest source-control credentials at scale.