JetBrains GoLand versions prior to 2026.2.2.1 contain a missing authentication flaw in the injected pprof server used by the Profiler. This flaw allows an attacker to retrieve the profiler's collected data without credentials, potentially exposing sensitive runtime information such as memory usage, goroutine stacks, and execution traces. The vulnerability is categorized as CWE-306, indicating a missing authentication mechanism.

The flaw affects JetBrains GoLand releases older than 2026.2.2.1. Users running those versions on any supported platform are vulnerable, regardless of other security controls. No specific operating system or architecture restrictions are noted.

The CVSS score of 5.9 indicates a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The exploitability depends on the reachability of the injected pprof server; if it is exposed to a local network or a user can trigger an HTTP request to the profiling endpoint, an attacker could retrieve profiling data. The attack vector is inferred as local or network, as the description does not specify a remote exploitation path. The lack of authentication makes the data exposed while the server is reachable.