CVE-2026-57922: 
YouTrack Schwachstellenanalyse und -minderung

CVE-2026-57922 is an information disclosure vulnerability in JetBrains YouTrack that allows project settings to be exposed via the MCP (Model Context Protocol) interface. It affects all YouTrack versions before 2026.2.16593 and was published on June 26, 2026. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium) per NVD, though JetBrains' own scoring via ENISA rates it at 3.1 (Low) with additional authentication requirements factored in (JetBrains Advisory, Feedly).

The root cause is classified as CWE-862 (Missing Authorization), meaning the MCP interface in YouTrack fails to enforce proper access controls before returning project settings data. An attacker can send network requests to the MCP interface without sufficient privilege checks, causing the application to disclose project configuration information that should be restricted. No user interaction is required, and the attack complexity is low, making it straightforward to trigger once the interface is reachable (Feedly, JetBrains Advisory).

Successful exploitation results in unauthorized disclosure of project settings, which may include sensitive configuration data such as workflow rules, access policies, custom field definitions, and integration configurations. The impact is limited to confidentiality (no integrity or availability impact), but exposed project settings could assist attackers in planning further targeted attacks against the organization's development infrastructure or identifying misconfigured access controls (Feedly).

JetBrains has released a patch in YouTrack version 2026.2.16593, which resolves the missing authorization check in the MCP interface. Organizations should upgrade to version 2026.2.16593 or later as the primary remediation step. As an interim workaround, network access controls should be implemented to restrict MCP interface access to authorized users and systems only, and administrators should audit project settings for any unauthorized disclosures that may have occurred prior to patching (JetBrains Advisory, Feedly).