Hub vulnerabilities and CVEs

Known vulnerabilities affecting Hub, with exploit availability attached to each one, so you can tell a flaw someone has written code for from one nobody has.

7 vulnerabilities tracked.

9.6 In JetBrains Hub before 2026.2.52556 privilege escalation was possible by changing email authentication details during the verification flow CVE-2026-123294 6 Nov 2026
8.1 In JetBrains Hub before 2026.2.52519 enforced two-factor authentication could be disabled via the profile update endpoint CVE-2026-123295 6 Nov 2026
7.5 In JetBrains Hub before 2026.2.52519 privilege escalation via forged email verification was possible CVE-2026-123296 6 Nov 2026
6.8 In JetBrains Hub before 2026.2.52519 two-factor authentication bypass was possible via the password reset flow CVE-2026-123297 6 Nov 2026
5.0 In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible CVE-2026-123298 6 Nov 2026
3.1 In JetBrains Hub before 2026.2.52519 information disclosure via user search queries was possible CVE-2026-123299 6 Nov 2026
2.7 In JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to modify auth module group mappings CVE-2026-123300 6 Nov 2026

What this covers

This feed accumulates forward from the day it started storing records, and a name search that finds nothing here is also looked up against the registers directly — so an older advisory resolves even when it predates the corpus. It is still a reading view, not a substitute for the vendor's own advisory, and absence from this page is not a statement that Hub is free of vulnerabilities.

Query this from an agent over MCP · Check a lockfile by version

Other products tracked here