IntelliJ IDEA versions prior to 2026.2.1 contain a server‑side request forgery vulnerability that can be triggered via the DevKit debug listener endpoint. The flaw allows an attacker to instruct the Integrated Development Environment to send HTTP requests to arbitrary URLs. Although it does not grant the attacker code execution, it can be used to access internal resources or exfiltrate sensitive data. This type of vulnerability is classified as CWE‑918.

JetBrains IntelliJ IDEA installations running a version earlier than 2026.2.1 and which have the DevKit debug listener enabled are affected. Users deploying the IDE with debugging support exposed over the network or locally are at risk.

The CVSS score of 5.4 indicates moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The most reasonable exploitation scenario assumes that the DevKit debug listener endpoint is reachable over the network or that a local attacker can invoke it. This detail is not stated explicitly in the CVE description and is inferred to assess exposure. If the endpoint is reachable, the attacker could send crafted requests to the IDE that would cause it to perform arbitrary HTTP requests, potentially enabling data exposure or internal network reconnaissance. Therefore, the risk depends on whether the DevKit debug listener is exposed or disabled.