JetBrains Fixes Critical IntelliJ IDEA RCE Flaw, Dozens of TeamCity, YouTrack Bugs

JetBrains has rolled out a sweeping round of security fixes across its IDE and DevOps toolchain, headlined by a critical path traversal vulnerability in IntelliJ IDEA that could allow arbitrary code execution.

The disclosure, tracked as CVE-2026-59792, is part of a broader patch cycle covering TeamCity, YouTrack, Hub, and Kotlin, underscoring how deeply embedded development pipelines have become a priority target for attackers hunting supply-chain footholds.

JetBrains Fixes Critical IntelliJ IDEA RCE Flaw

The most severe issue, CVE-2026-59792, stems from improper handling of project workspace IDs in IntelliJ IDEA, enabling code execution via path traversal (CWE-23). It was reported by researcher Antoni Tremblay and has been resolved in versions 2026.1.4 and 2026.2.

Because IntelliJ IDEA is a staple tool for millions of developers handling proprietary source code, a flaw of this severity in local project handling raises the stakes for anyone opening untrusted or shared codebases.

TeamCity, JetBrains’ CI/CD server, picked up four new High-severity CVEs in this cycle. CVE-2026-59793 allowed arbitrary file access via the Perforce VCS integration, while CVE-2026-59794 and CVE-2026-59795 both involved stored cross-site scripting one via agent-reported cloud profile data and the other through unauthenticated agent registration.

A fourth issue, CVE-2026-59796, permitted pipeline modification due to improper permission checks, a class of bug that has repeatedly plagued TeamCity’s build configuration model. All four are fixed in version 2026.1.2.

JetBrains’ identity management platform, Hub, was flagged for two Critical-severity issues tied to authentication logic. CVE-2026-56141 stemmed from predictable restore codes that could enable account takeover, while CVE-2026-56142 allowed privilege escalation by attaching authentication details to arbitrary accounts.

A third Critical flaw, CVE-2026-50242, involved an authentication bypass via direct database access, leading to full administrative control; this issue also affected YouTrack under the same CVE identifier, pointing to shared backend logic between the two platforms.

All three carry CWE classifications tied to weak credential generation (CWE-338) and improper authentication (CWE-306), core failure modes that security teams have long flagged as high-risk in enterprise identity systems.

YouTrack received fixes for a Low-severity CSS injection bug via Mermaid diagram rendering (CVE-2026-59791) and a stored XSS flaw triggered through article titles in digest emails (CVE-2026-61492).

Separately, Kotlin’s build tooling addressed a Medium-severity deserialization flaw in build cache metadata, CVE-2026-53914, which could lead to code execution and was reported by researcher Sherry Zhou.

Given the mix of Critical authentication bypasses and code-execution bugs, security teams running self-hosted TeamCity, YouTrack, or Hub instances should prioritize patching over routine maintenance windows.

Update IntelliJ IDEA to 2026.1.4 or 2026.2 to close CVE-2026-59792.
Patch TeamCity to 2026.1.2 for the Perforce, XSS, and pipeline permission fixes.
Apply Hub and YouTrack updates addressing the shared CVE-2026-50242 authentication bypass immediately, given its Critical rating.
Review Kotlin build cache configurations following the CVE-2026-53914 deserialization fix.

The volume and severity of this patch batch reflect a broader trend: development infrastructure, not just production systems, is now squarely in attackers’ crosshairs, and delayed patching of tools like TeamCity has historically preceded real-world exploitation campaigns.