Executive brief
JetBrains IntelliJ IDEA is a popular integrated development environment used by software developers. When a developer opens an untrusted project, an attacker can exploit the OpenAPI preview proxy feature to perform server-side request forgery (SSRF) attacks, potentially allowing unauthorized access to internal network resources or services running on the developer's machine.
Technical details
The vulnerability is a server-side request forgery (SSRF) in the OpenAPI preview proxy component of JetBrains IntelliJ IDEA. The flaw exists in versions before 2026.2.1 and is triggered when a developer opens an untrusted project. An attacker can craft a malicious project containing a specially crafted OpenAPI definition that causes the preview proxy to make unauthorized requests to internal systems or services. The attack requires user interaction (opening the untrusted project), but once triggered, allows the attacker to access internal network resources that would normally be isolated from external access. The vulnerability has been patched in IntelliJ IDEA 2026.2.1 and later.
Affected products
- JetBrains IntelliJ IDEA before 2026.2.1
Timeline
- 2026-08-17: disclosed
- 2026: patched: Fixed in IntelliJ IDEA 2026.2.1 and later