Executive brief
JetBrains GoLand, a popular development environment for the Go programming language, was found to be recording sensitive configuration information into its internal log files by default. If an unauthorized person gains access to these logs, they could potentially view private settings or credentials used by developers. This issue has been resolved in version 2026.2, and users are encouraged to update to prevent accidental data exposure.
Technical details
A vulnerability classified as CWE-532 (Insertion of Sensitive Information into Log File) exists in JetBrains GoLand versions prior to 2026.2. The application's default logging configuration captures sensitive configuration values, which are then stored in plaintext within the local log files. An attacker with low privileges or a remote attacker who can trick a user into sharing log files (UI interaction) could gain access to this sensitive information. The issue is mitigated by the requirement for log access, but it poses a risk of credential or secret leakage during troubleshooting or automated log collection. The vulnerability is fixed in GoLand 2026.2.
Affected products
- JetBrains GoLand before 2026.2
Timeline
- 2026-07-23: advisory: CVE-2026-64800 published by JetBrains
- 2026-07-23: patched: Fixed in version 2026.2