JetBrains IDEs: Embedded browser trusts revoked eMudhra certificates

Summary

Several JetBrains IDEs use an embedded browser (JCEF) that still trusted revoked intermediate certificates of the certificate authority eMudhra. The private keys of eight of these intermediate certificates were compromised. A network attacker who can intercept traffic may be able to impersonate websites in the embedded browser, provided the user accepts the connection.

Affected

• IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm: 2026.2 before 2026.2.4; 2026.1 before 2026.1.5.1; before 2025.3.6.2
• GoLand: 2026.2 before 2026.2.4; 2026.1 before 2026.1.5.1; before 2025.3.5.2
• Rider: 2026.2 before 2026.2.4; 2026.1 before 2026.1.5.3; before 2025.3.5.3
• CLion: 2026.2 before 2026.2.4.1; 2026.1 before 2026.1.5.2; before 2025.3.6.3
• DataGrip: 2026.2 before 2026.2.6.1; 2026.1 before 2026.1.4.1; before 2025.3.6.1
• RustRover: 2026.2 before 2026.2.5; 2026.1 before 2026.1.4.1; before 2025.3.7.1
• DataSpell: 2026.1 before 2026.1.3.1; before 2025.3.3.1

Fixed in

• IntelliJ IDEA, PyCharm, PhpStorm, RubyMine, WebStorm: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.6.2
• GoLand: 2026.3 RC, 2026.2.4, 2026.1.5.1, 2025.3.5.2
• Rider: 2026.3 EAP 9, 2026.2.4, 2026.1.5.3, 2025.3.5.3
• CLion: 2026.3 RC, 2026.2.4.1, 2026.1.5.2, 2025.3.6.3
• DataGrip: 2026.3 RC, 2026.2.6.1, 2026.1.4.1, 2025.3.6.1
• RustRover: 2026.3 EAP 8, 2026.2.5, 2026.1.4.1, 2025.3.7.1
• DataSpell: 2026.1.3.1, 2025.3.3.1
• The 2025.2 lines receive the JCEF fix as a separate hotfix; until then, use the workaround.
• Versions 2025.1 and earlier receive no fix.

Workaround

• Disable the embedded browser (JCEF) in the IDE as described on the vendor page until a fixed build is installed.
• If you cannot update, clean a copy of the bundled certificate list and remove the two eMudhra-related roots, as described on the vendor page.
• Developers should click Reject on untrusted-certificate warnings for eMudhra-issued certificates.

Exploitation

• No exploitation known at the time of publishing (vendor and CISA SSVC: exploitation none).
• CISA SSVC rates the issue as not automatable.
• Researchers recovered the eMudhra intermediate private keys; this is the root cause of the issue.

Our recommendation

• Inventory JetBrains IDEs, Toolbox App and Gateway on developer endpoints.
• Update to the fixed builds listed above and retire IDE lines 2025.1 and older.
• Also apply the jetbrainsd fix (CVE-2026-118697, jetbrainsd 0.9.9728) by updating Toolbox App to 3.9.1 or 3.8.2 or to a current IDE.
• If patching is delayed, apply the workaround and brief developers on certificate warnings.
• Recheck the NVD record and the vendor page once NVD analysis is complete.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• JetBrains blog: Compromised eMudhra certificates, update your IDEs blog.jetbrains.com
• JetBrains: Issues fixed www.jetbrains.com
• Mozilla bug 2083449: eMudhra private key compromise bugzilla.mozilla.org
• eMudhra: Certificate security incident emudhra.com
• Strix: CVE-2026-118696 www.strix.ai
• VulDB: CVE-2026-118696 vuldb.com
• Help Net Security: eMudhra certificates private keys compromised www.helpnetsecurity.com
• Casco: CVE-2026-118697 (jetbrainsd) casco.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 21:10.