CVE-2026-86501 Overview
CVE-2026-86501 is an information exposure vulnerability in JetBrains IntelliJ IDEA versions prior to 2026.2.2. The integrated terminal writes command input to the idea.log file, exposing potentially sensitive data. Sensitive content such as credentials, tokens, or command arguments may persist in log files readable by local users. The issue is tracked under CWE-532: Insertion of Sensitive Information into Log File. JetBrains addressed the flaw in IntelliJ IDEA 2026.2.2.
Critical Impact
Terminal command input, which may contain secrets or sensitive parameters, is written to idea.log and can be recovered by any actor with local read access to the log file.
Affected Products
- JetBrains IntelliJ IDEA versions prior to 2026.2.2
- Integrated terminal component of IntelliJ IDEA
- idea.log diagnostic log output on all supported operating systems
Discovery Timeline
- 2026-09-07 - CVE-2026-86501 published to NVD
- 2026-09-08 - Last updated in NVD database
Technical Details for CVE-2026-86501
Vulnerability Analysis
The vulnerability originates in the integrated terminal component of IntelliJ IDEA. Command input typed into the terminal is captured by the IDE's logging subsystem and written to idea.log. Developers frequently execute commands that include API keys, passwords, database connection strings, and access tokens. Persisting these values to a log file creates a durable secondary copy outside the terminal session.
The attack vector is local and requires low privileges plus user interaction, and the impact is limited to confidentiality. Exploitation depends on an actor having read access to the affected user's idea.log file, such as another local account, a backup process, or a diagnostic bundle shared with support.
Root Cause
The root cause is improper handling of sensitive input by the terminal logging path, mapped to [CWE-532]. Terminal input should be treated as potentially sensitive and excluded from diagnostic logs, or redacted before being persisted. The affected versions did not filter or mask this input prior to writing it to idea.log.
Attack Vector
An attacker with local access to a developer workstation, or access to shared diagnostic logs, can read idea.log and recover command lines the developer executed in the IDE terminal. Diagnostic bundles submitted to support, log files synchronized to backup shares, or logs collected by endpoint agents can extend the exposure beyond the original host.
No verified proof-of-concept code is available. See the JetBrains Security Issues Fixed page for vendor details.
Detection Methods for CVE-2026-86501
Indicators of Compromise
- Presence of terminal command strings, including flags and arguments, within idea.log files under the IntelliJ IDEA configuration or system directory.
- Log entries containing values that resemble API tokens, passwords, or connection strings originating from the terminal subsystem.
- Access to idea.log by processes or users unrelated to the IDE, including archival, backup, or telemetry agents.
Detection Strategies
- Audit idea.log files across developer endpoints for terminal command content, focusing on high-entropy strings and known secret patterns.
- Correlate IntelliJ IDEA version telemetry with the fixed version 2026.2.2 to identify hosts still exposed to the logging behavior.
- Scan diagnostic bundles and support archives previously exported from IntelliJ IDEA for the same patterns.
Monitoring Recommendations
- Monitor file access to idea.log and alert when non-IDE processes read the file.
- Include IntelliJ log directories in secret-scanning workflows that already cover source repositories.
- Track outbound transmission of files named idea.log or IntelliJ diagnostic archives from developer hosts.
How to Mitigate CVE-2026-86501
Immediate Actions Required
- Upgrade IntelliJ IDEA to version 2026.2.2 or later on all developer workstations.
- Rotate any credentials, tokens, or secrets that were entered into the IntelliJ terminal on affected versions.
- Purge historical idea.log files and previously exported diagnostic bundles that may contain terminal input.
Patch Information
JetBrains fixed the issue in IntelliJ IDEA 2026.2.2. Details are published on the JetBrains Security Issues Fixed page. Apply the update through the JetBrains Toolbox App, the in-IDE update mechanism, or your managed software distribution pipeline.
Workarounds
- Restrict filesystem permissions on the IntelliJ configuration directory so only the owning user can read idea.log.
- Avoid entering secrets directly into the IntelliJ integrated terminal; use environment variables, secret managers, or external terminal emulators until patched.
- Configure endpoint backup and log-collection tooling to exclude IntelliJ log directories, reducing secondary copies of exposed data.
# Restrict access to the IntelliJ log directory (Linux/macOS example)
# Replace <VERSION> with your installed IntelliJ IDEA version directory
chmod 700 "$HOME/.cache/JetBrains/IntelliJIdea<VERSION>/log"
chmod 600 "$HOME/.cache/JetBrains/IntelliJIdea<VERSION>/log/idea.log"
# Remove existing log files that may contain terminal input
rm -f "$HOME/.cache/JetBrains/IntelliJIdea<VERSION>/log/idea.log"*
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
