CVE-2025-42921: JetBrains Toolbox SSH Vulnerability

CVE-2025-42921 Overview

CVE-2025-42921 is a missing host key verification vulnerability in the JetBrains Toolbox App SSH plugin. Versions before 2.6 fail to validate SSH server host keys during connection establishment. This weakness maps to [CWE-297] (Improper Validation of Certificate with Host Mismatch) and enables man-in-the-middle (MITM) attacks against developers connecting to remote hosts through the Toolbox App.

Attackers positioned on the network path can intercept SSH sessions, capture authentication material, and manipulate data in transit. JetBrains addressed the issue in Toolbox App 2.6.

Critical Impact
Attackers with network access can intercept SSH connections, harvest credentials, and tamper with session data because the client does not verify the identity of the remote SSH host.

Affected Products

JetBrains Toolbox App versions prior to 2.6
Deployments across Windows, macOS, and Linux
Development environments relying on the Toolbox SSH plugin for remote host access

Discovery Timeline

2025-04-17 - CVE-2025-42921 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-42921

Vulnerability Analysis

The JetBrains Toolbox App integrates an SSH plugin that establishes connections to remote development hosts. In versions before 2.6, the plugin does not verify the server host key presented during the SSH handshake. SSH host key verification is the mechanism that binds a known cryptographic identity to a remote server, allowing clients to detect impersonation.

Without this check, the client accepts any host key returned by the endpoint at the target address. An attacker able to reroute traffic through techniques such as ARP spoofing, DNS poisoning, rogue Wi-Fi access points, or BGP hijacking can present a substitute key and terminate the SSH session on attacker-controlled infrastructure. The vulnerability primarily undermines confidentiality and integrity of SSH sessions initiated by the Toolbox App.

Root Cause

The SSH plugin omits the host key comparison step against a trusted known-hosts store. Standard OpenSSH clients reject unknown or mismatched host keys by default, but the Toolbox App implementation bypassed this control, treating any presented key as valid.

Attack Vector

Exploitation requires a network position between the developer workstation and the intended SSH server. The attacker terminates the SSH connection on a proxy configured with an attacker-controlled key pair, then optionally forwards traffic to the real destination to preserve the illusion of a working session. Password-based authentication exposes credentials directly to the attacker. Key-based authentication does not disclose the private key, but the attacker still controls the session channel, including any shell commands, forwarded ports, or transferred files.

No verified proof-of-concept code is published for this issue. Refer to the JetBrains Security Issues Fixed advisory for vendor details.

Detection Methods for CVE-2025-42921

Indicators of Compromise

Unexpected SSH host key changes reported by other clients connecting to the same remote hosts used by developers
Toolbox App SSH connections succeeding to endpoints that would normally trigger host key prompts in ssh or other clients
Anomalous ARP table entries, DNS responses, or gateway changes on developer network segments preceding SSH activity

Detection Strategies

Inventory installed JetBrains Toolbox App versions across developer endpoints and flag any build earlier than 2.6
Correlate outbound SSH sessions from workstations running vulnerable Toolbox versions against expected destination fingerprints
Monitor for TLS/SSH termination on unexpected internal hosts or on network paths that deviate from the documented route to remote development servers

Monitoring Recommendations

Enable network flow logging for SSH (TCP/22) sessions originating from developer subnets and alert on new or unusual destinations
Track software inventory telemetry for JetBrains Toolbox and generate alerts when versions below 2.6 remain present after the patch window
Review authentication logs on remote development servers for repeated connection attempts, key changes, or session anomalies that could indicate interception

How to Mitigate CVE-2025-42921

Immediate Actions Required

Upgrade the JetBrains Toolbox App to version 2.6 or later on every developer workstation
Rotate any SSH credentials, tokens, or passwords that were used through the Toolbox SSH plugin on vulnerable versions
Audit known_hosts files and remote server host keys for unexpected changes prior to the upgrade

Patch Information

JetBrains fixed the missing host key verification in Toolbox App 2.6. The vendor tracks the resolution on the JetBrains Security Issues Fixed page. Apply the update through the built-in Toolbox self-update mechanism or by downloading the current installer from JetBrains.

Workarounds

Use the standard OpenSSH client with a maintained known_hosts file instead of the Toolbox SSH plugin until the update is applied
Restrict SSH access from developer endpoints to trusted network paths, such as VPN tunnels or zero-trust network access, to reduce MITM exposure
Enforce SSH key-based authentication and disable password authentication on remote hosts to limit the value of intercepted sessions

bash

# Verify installed Toolbox version on Linux/macOS and confirm host key of a remote server
jetbrains-toolbox --version
ssh-keyscan -t ed25519,rsa remote-dev-host.example.com | ssh-keygen -lf -