JetBrains Patches Five Critical Flaws in Hub, IntelliJ IDEA, and Code With Me

If your team self-hosts JetBrains’ Hub, YouTrack, or TeamCity, or leans on Code With Me for remote pairing, JetBrains just shipped patches you don’t want to sit on. Five vulnerabilities across the on-premise ecosystem, three in Hub and two in the IntelliJ IDEA / Code With Me stack, cover the full range from account takeover to remote code execution.

The five vulnerabilities

CVE	Component	Impact
CVE-2026-56141	Hub	Account takeover via predictable restore codes (insufficient randomness, CWE-338)
CVE-2026-50242	Hub	Authentication bypass via direct database access, granting admin control without credentials
CVE-2026-56142	Hub	Privilege escalation via unsafe linking of authentication records to accounts
CVE-2026-49366	IntelliJ IDEA	Command injection triggered via filename completion
CVE-2026-49367	IntelliJ IDEA / Code With Me	Low-privileged guest in a collaboration session can execute commands on the host

Three of these live in Hub, the shared identity and user-management layer that sits in front of JetBrains’ other on-premise server products. That’s a meaningful detail: a bug in Hub isn’t scoped to one tool, it’s scoped to whatever authentication boundary Hub is supposed to be enforcing for everything behind it.

Why the Hub bugs matter more than a typical auth bug

CVE-2026-56141 is an account-recovery flaw. Hub’s restore-code generation didn’t have enough entropy, so an attacker who can predict or brute-force the code space can hijack an account through the “I forgot my credentials” flow rather than the login form. Recovery paths exist to be a safety net, not a shortcut, and a predictable one defeats the purpose of the primary authentication it’s supposed to back up.

CVE-2026-50242 is more direct: authentication bypass via direct database access, which gets an attacker administrative control without valid credentials at all. Combined with CVE-2026-56142, a privilege escalation bug where an already-authenticated user can manipulate linked authentication records to promote their own access, the practical read is that Hub had three independent routes to elevated access, not one bug with three symptoms.

Attack surface before patching:

  Unauthenticated attacker
      │
      ├─ CVE-2026-56141: guess/predict restore code ──► account takeover
      ├─ CVE-2026-50242: direct DB access ─────────────► admin, no credentials
      │
  Authenticated low-privilege user
      │
      └─ CVE-2026-56142: manipulate auth record links ─► privilege escalation

If you’re running any 2024–2026 release line of Hub, all three apply until you’re on a patched build. Fixes landed in Hub 2026.1.13757, with backports to the 2025.3, 2025.2, 2025.1, 2024.3, and 2024.2 LTS branches, so check your exact branch rather than assuming a recent-ish install is covered.

The IDE-side risk: Code With Me

CVE-2026-49367 is the one worth flagging separately, because it changes who counts as a plausible attacker. Code With Me is JetBrains’ built-in pair-programming feature: one developer hosts a session, others join as guests with configurable permission levels. The vulnerability lets a low-privileged guest in a Code With Me session execute commands on the host’s machine, bypassing the permission boundary the feature is built around.

That matters because the threat model for “someone I invited into a live coding session” is normally “a colleague or a vetted external collaborator,” not “an attacker with arbitrary code execution on my laptop.” A bug here quietly upgrades every guest invite into a decision with more consequence than most developers realize they’re making. CVE-2026-49366, a command injection bug triggered via filename completion in the same IDE line, is a smaller-scope companion issue but worth patching in the same pass since it ships in the same release.

What to do

1. Update Hub first if you self-host it. Move to 2026.1.13757 or the appropriate backported LTS build for your branch. This is the component with the most severe and most numerous fixes.
2. Update IntelliJ IDEA and any IntelliJ-based IDE (WebStorm, PyCharm, GoLand, and others share the platform) to the current release to pick up the Code With Me and filename-completion fixes.
3. Audit recent Code With Me sessions if you run this feature regularly with external collaborators, particularly any sessions granted guest access before you patched.
4. Rotate credentials tied to Hub-managed accounts if you have reason to believe CVE-2026-50242 or CVE-2026-56141 could have been exploited against your instance before patching, since both bugs bypass normal authentication rather than merely weakening it.

If you’re evaluating your team’s broader exposure to this class of issue, the tradeoffs between different authentication protocols are worth revisiting alongside patch management. A well-designed auth protocol doesn’t help if the identity provider sitting in front of it has an unpatched bypass, which is exactly the situation Hub’s users were in here.

Developer tooling doesn’t get the same security scrutiny as production-facing infrastructure, mostly because it feels internal. Bugs like these are the reminder that “internal” and “low-risk” aren’t the same thing, especially for a tool like Hub that’s explicitly an identity boundary, or a feature like Code With Me that’s explicitly designed to let outside collaborators onto your machine.