CVE-2026-50242: In JetBrains Hub before 2026

Synopsis

An authentication bypass vulnerability in JetBrains Hub allows a remote, unauthenticated attacker to gain administrative access by directly accessing the underlying database. The flaw is reachable over the network with no credentials and no user interaction required, making it trivially exploitable wherever Hub is network-accessible. Successful exploitation gives an attacker full administrative control over the Hub instance, enabling complete data disclosure, modification of all persisted data, and disruption of service. Patched-image rebuilds at the fixed versions are available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Hub service over the network; any internet-exposed or internally network-accessible Hub instance is within scope.

• AuthenticationNot required

  No credentials of any kind are required; the bypass allows an unauthenticated attacker to gain administrative access directly.

• Victim interactionNot required

  The attack is fully server-side and requires no action from any user or administrator.

• Attack complexityDetail

  Exploit complexity is low, meaning the attack is reliable and requires no special conditions, race conditions, or environmental factors to succeed.

Blast Radius

• A successful attacker gains full administrative control over the JetBrains Hub instance, reading all stored user credentials, tokens, and project access configurations.
• The attacker can modify or delete all persisted data in Hub, including user accounts, group memberships, permissions, and integration settings across every connected JetBrains service.
• The scope of impact extends beyond Hub itself (CVSS scope is Changed), meaning downstream JetBrains tools integrated with Hub, such as TeamCity or YouTrack, inherit the attacker's administrative privileges.
• The attacker can crash or disable the Hub service entirely, cutting off authentication and access management for all integrated tooling in the affected organization.