Executive brief
IntelliJ IDEA is a widely-used integrated development environment (IDE) for Java and other languages. A vulnerability in the Kubernetes integration could allow an attacker to trick a developer into opening a malicious project file, causing the IDE to fetch URLs from internal network resources. This could expose internal services and credentials not directly accessible to the attacker.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability exists in IntelliJ IDEA's Kubernetes spec-source URL handling. When opening an untrusted project, the IDE automatically fetches and processes Kubernetes specification URLs specified in project configuration files without proper validation or isolation. An attacker can craft a malicious project file with a Kubernetes spec-source URL pointing to internal services, causing the IDE process to make requests to internal network addresses. This requires user interaction (opening the project) and affects only local IDE processes, but could leak information about internal infrastructure and services. The vulnerability is fixed in version 2026.2.2 and later.
Affected products
- JetBrains IntelliJ IDEA before 2026.2.2
Timeline
- 2026-09-07: disclosed
- 2026-09-07: patched: Fix available in version 2026.2.2 and later