CVE-2026-86501: 
JetBrains IntelliJ IDEA vulnerability analysis and mitigation

CVE-2026-86501 is an information disclosure vulnerability in JetBrains IntelliJ IDEA where terminal command input can be written to the idea.log file, potentially exposing sensitive data such as credentials or tokens entered in the integrated terminal. It affects all versions of IntelliJ IDEA before 2026.2.2. The vulnerability was published on September 7, 2026, and a patch is available. It carries a CVSS v3.1 base score of 2.8 (Low) (GitHub Advisory, JetBrains).

The root cause is classified as CWE-532 (Insertion of Sensitive Information into Log File). When a user types commands in IntelliJ IDEA's integrated terminal, those inputs are inadvertently logged to the idea.log file rather than being handled exclusively in memory. Exploitation requires local access to the system, low privileges, and user interaction (i.e., a user must actively type a command in the terminal). No public proof-of-concept or technical write-up detailing the precise logging mechanism has been published (GitHub Advisory).

Successful exploitation results in a limited confidentiality impact: sensitive terminal input — such as passwords, API keys, or authentication tokens typed into the IntelliJ IDEA terminal — may be written to idea.log and subsequently read by other local users or processes with access to that log file. There is no impact on integrity or availability. The scope is limited to the local system, and there is no direct path to remote code execution or lateral movement from this vulnerability alone (GitHub Advisory).

There is no evidence of active in-the-wild exploitation, and no public proof-of-concept exists (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.272%, placing it in the 19th percentile for exploitation likelihood within 30 days. Exploitation is non-automatable and requires a local attacker with read access to the idea.log file after a legitimate user has typed sensitive input in the terminal.

1. Gain local access: Obtain a low-privileged local account on a system running JetBrains IntelliJ IDEA prior to version 2026.2.2.
2. Wait for user interaction: Wait for or social-engineer a target user to type sensitive commands (e.g., commands containing passwords, API tokens, or secret keys) in the IntelliJ IDEA integrated terminal.
3. Locate the log file: Navigate to the IntelliJ IDEA log directory, typically found at ~/.cache/JetBrains/IntelliJIdea<version>/log/idea.log on Linux/macOS or %APPDATA%\JetBrains\IntelliJIdea<version>\log\idea.log on Windows.
4. Extract sensitive data: Search the idea.log file for terminal command entries containing credentials or tokens entered by the user (GitHub Advisory).

• File System: Unexpected read access to idea.log by processes or users other than the IntelliJ IDEA application owner; presence of sensitive strings (passwords, tokens) within idea.log.
• Logs: OS-level audit logs (e.g., Linux auditd) showing unauthorized file reads of the IntelliJ IDEA log directory by non-owner accounts.
• Process: Unusual processes (e.g., scripts, grep, or log-scraping tools) accessing ~/.cache/JetBrains/ or %APPDATA%\JetBrains\ directories.

The primary remediation is to update JetBrains IntelliJ IDEA to version 2026.2.2 or later, which resolves the issue (JetBrains). As a workaround prior to patching, restrict file system permissions on the idea.log file and its parent directory to prevent access by other local users or processes. Additionally, avoid entering sensitive credentials or tokens directly in terminal commands within IntelliJ IDEA until the patch is applied — prefer environment variables or credential managers instead.