CVE-2026-123294JetBrains Hub

Not on CISA's list of exploited flaws, and not in the news we track.

SeverityCVSS

9.6of 10, critical

010

Reading the vendor advisory

Fix it in one click

Fix it in your code

Explain it to me

Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-123294. Nothing runs until you send it.

In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow

Not on CISA's list of exploited flaws, and not in the news we track.

SeverityCVSS

9.6of 10, critical

010

You are affected if

Anyone running a self-hosted JetBrains Hub server before version 2026.2.52556, especially with email verification enabled.

The fix

Upgrade JetBrains Hub to version 2026.2.52556 or later; no other mitigation is listed.

Reading the vendor advisory

Fix it in your code

Explain it to me

Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-123294. Nothing runs until you send it.

In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow