Multiple security vulnerabilities have been identified in JetBrains development environments and related background services, affecting desktop IDEs, the embedded browser, and a background daemon. The issues stem from improper certificate validation and revocation handling, allowing network attackers to present fraudulent certificates and intercept or manipulate developer traffic. The overall risk is severe, with potential for man-in-the-middle attacks against software development workflows. Affected versions include 2025.1.
CVE-2026-118697 (CVSS 9.0 — Critical): This improper certificate validation flaw affects the background service that runs alongside desktop IDEs and handles local background tasks. A network attacker who can intercept communications with that service could present a fraudulent certificate and spoof backend services or manipulate software installations.[/subscribe_to_unlock_form]
Multiple security vulnerabilities have been identified in JetBrains development environments and related background services, affecting desktop IDEs, the embedded browser, and a background daemon. The issues stem from improper certificate validation and revocation handling, allowing network attackers to present fraudulent certificates and intercept or manipulate developer traffic. The overall risk is severe, with potential for man-in-the-middle attacks against software development workflows. Affected versions include 2025.1.
CVE-2026-118697 (CVSS 9.0 — Critical): This improper certificate validation flaw affects the background service that runs alongside desktop IDEs and handles local background tasks. A network attacker who can intercept communications with that service could present a fraudulent certificate and spoof backend services or manipulate software installations.[emaillocker id="1283"]
CVE-2026-118696 (CVSS 8.0 — High): This improper certificate revocation check affects the embedded browser used for documentation and web previews inside the IDEs. A network attacker could present a revoked intermediate certificate and have the browser accept it, enabling interception of developer web traffic.
CVE-2026-91403: This issue affects the bundled runtime trust store used by the development environments. It involves continued trust in compromised certificate authorities, allowing a network attacker to forge valid certificates and impersonate services connected to by the IDEs.
CVE-2026-114820: This issue also affects the bundled runtime trust store and involves reliance on compromised certificate authorities. A network attacker could exploit that trust to present fraudulent certificates and intercept or alter communications between development tools and their services.
These vulnerabilities collectively present a severe risk to developers and organizations that use affected desktop IDEs and background services, because network attackers could intercept or manipulate secure development traffic. The most at risk are users of affected development environments, and the general action is to ensure those components are no longer exposed to the certificate trust issues.
The following reports contain further technical details:
[/emaillocker]