CVE-2026-86506
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
In JetBrains GoLand before 2026.2.2.1, missing authentication on the GoLand profiler's injected pprof server exposed profiling data.
Risk Assessment
Attackers may gain access to profiling data, potentially revealing information about application behavior, sensitive data, or implementation details. This could aid further attacks.
Recommendation
Update GoLand to version 2026.2.2.1 or later, which contains the fix. Also ensure the pprof server is not publicly accessible.
Other vulnerabilities in JetBrains GoLand
See all- CVE-2026-64803High
In JetBrains GoLand before 2026.2, arbitrary code execution was possible before granting project trust via the configured Go SDK.
- CVE-2026-64802High
In JetBrains GoLand before 2026.2, arbitrary code execution was possible before granting project trust in the Go Modules integration.
- CVE-2026-64800Low
In JetBrains GoLand before 2026.2 sensitive configuration values are written to log files by default.
- CVE-2026-53915High
In JetBrains GoLand before 2026.1.3 remote code execution was possible via untrusted project configuration.
Original NVD description (English source)
In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data
Vulnerability data from NVD (NIST) · CISA KEV · EPSS