JetBrains IntelliJ IDEA performs an insecure addition of server certificates to its trust store when it runs in headless mode because certain validation checks are bypassed. The result is that a malicious or rogue certificate can be accepted and stored as a trusted authority. If an attacker can influence a headless run, they may be able to intercept or masquerade HTTPS traffic for automated build processes, potentially compromising confidentiality and integrity of data processed during those runs.

JetBrains IntelliJ IDEA versions earlier than 2026.3 are vulnerable. Any installation of IntelliJ IDEA 2026.2 or earlier that is configured to run in headless mode (such as in CI/CD pipelines) is affected.

The CVSS score of 7.4 classifies the vulnerability as high severity, and the lack of an EPSS score indicates insufficient data on exploitation frequency. The issue is not listed in CISA's KEV catalog. The attack vector is inferred to be a local or remote execution of a headless run that can be controlled or influenced by an attacker. Once the vulnerability is exploited, the attacker gains persistence by adding a malicious certificate to the IDE's trust store, affecting all subsequent communications that rely on that store. The risk is elevated in automated build environments where trust stores may be shared across multiple builds or services.