PT-2026-86852 · Jetbrains · Hub
CVE-2026-86480
·
Published
2026-09-07
·
Updated
2026-09-09
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
🚨Critical - JetBrains Hub Unauth Trusted Service Registration PrivEsc (CVE-2026-86480)
JetBrains Hub exposes a critical trusted-service registration endpoint where the service trust flag can be set without authentication. An unauthenticated attacker can register a malicious trusted service, then obtain superuser privileges via elevated service-to-Hub permissions. Properly authenticated service registration flows are not impacted.
👉Affected: JetBrains Hub < 2026.2.52442 | Upgrade to 2026.2.52442
Fix
Missing Authentication
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Hub