Executive brief
IntelliJ IDEA is a popular integrated development environment used by software developers. A flaw in how the IDE handles XML files related to Hadoop ResourceManager configuration allows an attacker to read sensitive files from a developer's local machine. An exploit could expose credentials, source code, or other confidential data stored on the developer's computer.
Technical details
The vulnerability is an XML External Entity (XXE) injection flaw in IntelliJ IDEA's Hadoop ResourceManager integration. The vulnerable component fails to properly disable external entity processing when parsing XML configuration files. An attacker can craft a malicious Hadoop configuration file that, when processed by the IDE, resolves external entities to read arbitrary files from the developer's system. No authentication is required, but the attacker must be able to place or control a project configuration file that the user opens in IntelliJ IDEA. The vulnerability is fixed in version 2026.2.1 and later.
Affected products
- JetBrains IntelliJ IDEA before 2026.2.1
Timeline
- 2026-08-17: disclosed
- 2026-08-17: patched: Fixed in version 2026.2.1