CVE-2026-86480
CriticalCVSS 9.8Summary
In JetBrains Hub before 2026.2.52442, an unauthenticated attacker could register a trusted service and gain superuser privileges.
Risk Assessment
The risk includes full system takeover by an unauthenticated attacker, leading to data confidentiality, integrity, and availability breaches.
Recommendation
Update JetBrains Hub to version 2026.2.52442 or later.
Other vulnerabilities in JetBrains Hub
See all- CVE-2026-56142Critical
In JetBrains Hub before versions 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429, a privilege escalation vulnerability existed by attaching authentication details to accounts.
- CVE-2026-56141Critical
In JetBrains Hub before versions 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429, account takeover via predictable restore codes was possible.
- CVE-2026-50242Critical
In JetBrains Hub before versions 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430, and 2024.2.148429, authentication bypass via direct database access leading to administrative access was possible.
Original NVD description (English source)
In JetBrains Hub before 2026.2.52442 an unauthenticated attacker could register a trusted service and gain superuser privileges