JetBrains Toolbox App and IDEs: Improper certificate validation in jetbrainsd
Summary
The jetbrainsd background service, installed by the JetBrains Toolbox App and JetBrains IDEs such as IntelliJ IDEA, trusts intermediate certificates from the certificate authority eMudhra whose private keys were compromised. An attacker in a network position to intercept traffic could impersonate websites and services that these tools connect to. The attack requires a man-in-the-middle position with high complexity, but no privileges and no user interaction.
Affected
- JetBrains Toolbox App before 3.9.1 and before 3.8.2
- JetBrains IntelliJ IDEA before 2026.3 and before 2026.2.4
- Toolbox App 3.7 and earlier and IDE versions 2025.1 and earlier receive no fix and remain affected.
Fixed in
- Toolbox App 3.9.1 or 3.8.2 (includes jetbrainsd 0.9.9728)
- jetbrainsd 0.9.9728 or later
- IntelliJ IDEA 2026.2.4, 2026.1.5.1, 2025.3.6.2 or 2025.2.6.4 (per vendor list; the stable 2026.3 status is unknown)
Workaround
- No workaround is needed once a fixed version is installed.
- Until updated, reject any untrusted server certificate warning for an eMudhra-issued certificate instead of accepting it.
- Operating system updates do not fix this issue.
Exploitation
- No exploitation known at publication; JetBrains is not aware of any exploitation against its users.
- No public proof of concept specific to this CVE found.
- The compromised eMudhra keys are publicly documented, and an attacker would still need a network position to intercept traffic.
Our recommendation
- Update the Toolbox App to 3.9.1 or 3.8.2 on all developer workstations; this also updates jetbrainsd.
- Update all JetBrains IDEs to the latest bugfix release of your current version.
- Upgrade Toolbox App 3.7 and earlier and IDEs 2025.1 and earlier, as they receive no fix.
- Prioritise developers working on untrusted networks such as public Wi-Fi or while travelling.
- Watch for certificate warnings for eMudhra certificates in JetBrains tools.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- JetBrains Blog: Compromised eMudhra Certificates blog.jetbrains.com
- JetBrains Issues Fixed www.jetbrains.com
- JetBrains Blog: eMudhra CA incident status and guidance blog.jetbrains.com
- Mozilla Bugzilla 2083449: eMudhra private key compromise bugzilla.mozilla.org
- eMudhra certificate security incident emudhra.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 07:57.
Original description (NVD)
In JetBrains Toolbox App before 3.9.1 and 3.8.2; IntelliJ IDEA before 2026.3 and 2026.2.4, the jetbrainsd daemon trusted compromised intermediate certificates
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.