The vulnerability in JetBrains YouTrack before 2026.2.19422 permits server side request forgery through its GitHub VCS integration. An attacker can craft requests that cause the YouTrack server to send arbitrary HTTP requests to external resources, potentially leaking internal data or performing unwanted actions. The CVSS score of 5.5 indicates a moderate severity, but the ability to reach arbitrary hosts could be leveraged for further attacks.

JetBrains YouTrack installations running any version prior to 2026.2.19422 are affected. The issue is tied to the built‑in GitHub VCS integration component and therefore applies to all instances using that feature.

The lack of an EPSS score and the fact that the vulnerability is not listed in the CISA KEV catalog suggest that exploitation in the wild has not been observed. Nevertheless, the moderate CVSS score and the nature of an sSRF attack mean that remote attackers could exploit exposed GitHub connections to reach internal services or perform phishing. Without a patch, the risk remains moderate but could grow if attackers discover additional vectors or combine this flaw with other weaknesses.