CVE-2026-86502 Overview
CVE-2026-86502 is a missing authentication vulnerability in JetBrains IntelliJ IDEA affecting versions before 2026.2.2. The IJent gRPC server, a component used by IntelliJ IDEA's Remote Development feature, ships without Transport Layer Security (TLS) or authentication controls. A local attacker on a Remote Development host can connect to the exposed gRPC endpoint and execute code in the context of the IDE user. The flaw is classified under CWE-306: Missing Authentication for Critical Function. JetBrains addressed the issue in IntelliJ IDEA 2026.2.2.
Critical Impact
Local users on Remote Development hosts can execute arbitrary code as the IntelliJ IDEA user by connecting to the unauthenticated IJent gRPC server.
Affected Products
- JetBrains IntelliJ IDEA versions prior to 2026.2.2
- IntelliJ IDEA Remote Development deployments exposing the IJent gRPC server
- Multi-user hosts where IntelliJ IDEA Remote Development is installed
Discovery Timeline
- 2026-09-07 - CVE-2026-86502 published to the National Vulnerability Database (NVD)
- 2026-09-09 - Last updated in NVD database
Technical Details for CVE-2026-86502
Vulnerability Analysis
The vulnerability resides in the IJent gRPC server component that IntelliJ IDEA uses for Remote Development. IJent brokers filesystem and process operations between a remote backend and the IDE frontend. When the gRPC server starts, it binds a listener without negotiating TLS and without validating any client credential. Any process running on the same host as the IJent server can therefore establish a gRPC channel and invoke IJent's remote procedure calls. Because IJent exposes primitives for process execution and filesystem access, an attacker can leverage the channel to run commands as the user hosting the IDE session.
Root Cause
The root cause is the absence of authentication and transport encryption on a critical control-plane service, matching the [CWE-306] pattern. IJent's gRPC endpoint trusts any local caller and does not enforce a shared secret, mutual TLS, or Unix socket permissions sufficient to isolate the IDE user from other local principals. Remote Development scenarios often place multiple users, service accounts, and CI processes on the same host, expanding the local attack surface.
Attack Vector
Exploitation requires local access to the Remote Development host. An attacker with an unprivileged shell enumerates the IJent gRPC listener, opens a plaintext gRPC connection, and issues RPCs that spawn processes or manipulate files. No user interaction is required, and the attacker inherits the privileges of the IntelliJ IDEA user. In shared development environments this can enable lateral movement between developer accounts or escalation to service identities that own the IDE session. Refer to the JetBrains Security Issues Fixed advisory for vendor confirmation.
Detection Methods for CVE-2026-86502
Indicators of Compromise
- Unexpected child processes spawned by the IntelliJ IDEA or IJent backend process on Remote Development hosts.
- Local gRPC connections to the IJent listener originating from user accounts other than the IDE owner.
- New or modified files under project workspaces without corresponding IDE activity from the legitimate user.
Detection Strategies
- Inventory hosts running IntelliJ IDEA Remote Development and confirm the installed build is 2026.2.2 or later.
- Baseline the process tree of ijent and IntelliJ backend processes, then alert on deviations such as shells, package managers, or network tools.
- Monitor local socket activity for connections to the IJent gRPC port from unexpected UIDs.
Monitoring Recommendations
- Forward endpoint process and socket telemetry from Remote Development hosts to a centralized analytics pipeline for correlation.
- Enable auditd or equivalent Linux auditing on the accounts hosting IntelliJ IDEA Remote Development to capture execve events tied to the IJent process.
- Track authentication and sudo activity on shared Remote Development hosts to identify secondary local users who could reach the gRPC listener.
How to Mitigate CVE-2026-86502
Immediate Actions Required
- Upgrade all IntelliJ IDEA installations used for Remote Development to version 2026.2.2 or later.
- Restrict interactive and service account access on Remote Development hosts to the developers who require it.
- Audit existing Remote Development hosts for signs of unauthorized process execution prior to the upgrade.
Patch Information
JetBrains resolved CVE-2026-86502 in IntelliJ IDEA 2026.2.2 by adding TLS and authentication to the IJent gRPC server. Details are published on the JetBrains Security Issues Fixed page. Administrators should redeploy Remote Development backends after upgrading to ensure the new IJent binary is in use.
Workarounds
- Limit Remote Development hosts to a single trusted user where feasible to remove local co-tenants.
- Apply host-based firewall or socket permission controls to block non-IDE users from reaching the IJent listener until the patch is applied.
- Suspend Remote Development on multi-tenant hosts until upgrades to 2026.2.2 are complete.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
