CVE-2026-86497 Overview
CVE-2026-86497 is an information exposure vulnerability in JetBrains YouTrack versions prior to 2026.2.18769. The flaw allows a project administrator to exfiltrate stored mailbox credentials by changing a mailbox host without triggering re-authentication. The weakness is categorized as [CWE-201] (Insertion of Sensitive Information Into Sent Data). Because YouTrack stores credentials for mailbox integrations, an authenticated project administrator can redirect the mailbox client to a host they control and capture the credentials in transit.
Critical Impact
An authenticated project administrator can exfiltrate stored mailbox credentials by pointing the integration at an attacker-controlled host, leading to credential compromise for connected mail accounts.
Affected Products
- JetBrains YouTrack versions before 2026.2.18769
- YouTrack mailbox integration component
- Deployments where project administrator role is delegated to non-privileged users
Discovery Timeline
- 2026-09-07 - CVE-2026-86497 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-86497
Vulnerability Analysis
YouTrack supports mailbox integrations that store credentials used to connect to remote mail servers. The mailbox configuration exposes a host field that a project administrator can modify. In vulnerable releases, changing the host does not invalidate the stored credentials or force the administrator to re-enter them. The next connection attempt sends the previously stored username and password to the new host without confirmation.
An attacker with project administrator privileges edits the mailbox host to point at a server they control. The YouTrack server then authenticates to the attacker's endpoint using the stored credentials, exposing them in cleartext or in a form the attacker can capture. The scope change (S:C) reflects that credentials belonging to another security authority are disclosed.
Root Cause
The root cause is missing re-authentication when a sensitive integration parameter changes. YouTrack treats mailbox host changes as routine configuration edits rather than as security-relevant operations. There is no check that the new host matches the original credential's intended destination, and no requirement to re-supply credentials when the destination changes.
Attack Vector
The attack is network-based and requires an authenticated user with project administrator permissions. The attacker modifies a mailbox integration in the YouTrack UI or API, replacing the legitimate host with an SMTP or IMAP server they operate. When YouTrack initiates the next mailbox connection, it presents the stored credentials to the attacker's server. See the JetBrains Security Issues Fixed advisory for vendor details.
// No verified exploit code is available for this vulnerability.
// The attack flow is: modify mailbox host -> trigger connection ->
// capture credentials on attacker-controlled mail server.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-86497
Indicators of Compromise
- Mailbox integration configuration changes where the host field was modified without a corresponding credential update.
- Outbound SMTP or IMAP connections from the YouTrack server to unexpected external hosts.
- Authentication attempts logged on unfamiliar mail servers using accounts configured in YouTrack.
- Audit log entries showing project administrator edits to mailbox integrations outside of change windows.
Detection Strategies
- Review YouTrack audit logs for mailbox or integration configuration events and correlate host changes with the actor performing them.
- Baseline the legitimate mailbox hosts used by YouTrack and alert on any deviation.
- Monitor egress traffic from the YouTrack host and flag SMTP/IMAP/POP3 connections to destinations outside an allowlist.
Monitoring Recommendations
- Ingest YouTrack audit logs into a SIEM and build detections for administrator role changes and mailbox integration edits.
- Rotate any mail credentials configured in YouTrack if audit logs show unexplained host changes.
- Track failed and successful authentication events on the mail servers referenced by YouTrack integrations.
How to Mitigate CVE-2026-86497
Immediate Actions Required
- Upgrade JetBrains YouTrack to version 2026.2.18769 or later.
- Audit all mailbox integrations and confirm the configured host matches the intended mail server.
- Rotate credentials for any mailbox account whose host was modified by a project administrator prior to patching.
- Restrict the project administrator role to trusted users and remove it from accounts that do not require it.
Patch Information
JetBrains addressed the issue in YouTrack 2026.2.18769. Refer to the JetBrains Security Issues Fixed page for the vendor advisory and release notes. Cloud-hosted YouTrack instances are updated by JetBrains; self-hosted deployments must be upgraded by administrators.
Workarounds
- Limit project administrator assignments to a minimal set of accounts until the upgrade is applied.
- Configure egress filtering on the YouTrack server to allow SMTP/IMAP only to approved mail servers.
- Use dedicated service accounts with least-privilege mailbox permissions so that credential exposure has bounded impact.
# Example: restrict outbound mail protocols to an approved host
iptables -A OUTPUT -p tcp -m multiport --dports 25,465,587,143,993,110,995 \
-d mail.example.com -j ACCEPT
iptables -A OUTPUT -p tcp -m multiport --dports 25,465,587,143,993,110,995 \
-j REJECT
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
