JetBrains patches 61 flaws across developer tools

JetBrains has issued a sweeping set of security updates addressing 61 CVEs across Hub, Datalore, YouTrack, and IntelliJ IDEA, among other JetBrains tooling. The standout flaws are CVE-2026-123294 in Hub (CVSS 9.6) and CVE-2026-123279 in Datalore (CVSS 9.0), with the former allowing an attacker to alter email login details during the sign-in flow to gain admin rights, and the latter exposing weak access checks that permit view-only users to run arbitrary code within notebook tasks.

The roundup also notes additional high- and medium-severity issues across the ecosystem, including CVE-2026-123295 (Hub) which enables turning off enforced two‑factor authentication, and CVE-2026-123296 (Hub) for privilege escalation via fake email checks, and CVE-2026-123280 (Datalore) enabling code execution by unauthorised users through public reports. The report attributes these vulnerabilities to multiple JetBrains components, with YouTrack, Ktor, and several desktop IDEs also affected by numerous fixes.

The article lists affected versions and the corresponding patches: Hub prior to 2026.2.52556, Datalore prior to 2026.4, YouTrack prior to 2026.2.19728, and Ktor prior to 3.6.1. Desktop IDEs and tooling are said to require updates to IntelliJ IDEA, WebStorm, and CLion to 2026.3 or 2026.2.4, Junie CLI to 26.8.24, and Toolbox App to 3.9. It notes that, as of the report, there is no confirmed exploitation in the wild for these flaws, and claims the highest severity CVSS score among the set is 9.6 for CVE-2026-123294.

The piece, attributed to Do Son of SecurityOnline[.]info, also documents the broader impact on nine JetBrains tools used by millions of developers for builds, issue tracking, and data workspaces, underscoring the urgency for timely patching.