In JetBrains IntelliJ IDEA versions prior to 2026.3, the IDE could open unauthenticated connections to any host specified in a run configuration. By providing a malicious run configuration, an attacker can force the IDE to connect to an arbitrary external endpoint, potentially exfiltrating data or executing remote code within the user’s environment. This flaw is associated with CWE-918 and allows attackers to establish an outbound connection without any user authentication or consent.

The vulnerability affects JetBrains IntelliJ IDEA software on all platforms. Any installation of IntelliJ IDEA before version 2026.3, including the specific release 2026.2.4 mentioned in the advisory, is vulnerable. The flaw is present in all product editions that support run configurations.

The issue has a CVSS score of 6.8, indicating moderate severity. No EPSS data is available, and the vulnerability is not listed in CISA's KEV catalog. Exploitation would likely require an attacker to supply or convince a user to load a malicious run configuration file, after which the IDE would initiate an outbound connection. Because the flaw permits connections without authentication, it poses a moderate risk of data leakage and remote code execution from the victim’s machine. The lack of a KEV listing suggests there are no known large‑scale exploits yet, but the potential impact warrants timely remediation.