CVE-2026-50242 is a critical (CVSS 10.0) authentication bypass in JetBrains Hub. The record says direct database access could lead to administrative access. Update Hub to a build at or after 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430 or 2024.2.148429.
What's affected
- Product: JetBrains Hub, the authentication and permissions service used with other JetBrains Team Tools.
- Affected: builds before 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430 and 2024.2.148429, on their respective release lines.
- Fixed: those build numbers or later, as stated in the record. Confirm in JetBrains' fixed security issues page.
- Weakness: CWE-306, missing authentication for a critical function.
- CVSS 10.0 (critical), vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. - Published 19 June 2026. Not marked as exploited in CISA KEV.
The CVE text is short, and the JetBrains page was a list I could not read in detail. I have not confirmed more about the mechanism than the record says.
How to check if you're exposed
The version of Hub is shown in the Hub administration area and in the build number of your installation. For Docker based installs, check the image tag.
docker ps --format '{.Image}' | grep -i hub
Compare your build number with the list above for your release line. If you are on a line that is not listed, check JetBrains' security issues page for your version.
Also consider the other half of the description: direct database access. Look at who and what can reach the database that Hub uses, and close anything that does not need it.
What to do now
- Update Hub to a fixed build for your release line.
- Restrict network access to the Hub database to the Hub server alone, and use strong, rotated database credentials.
- Review administrator accounts and recent permission changes in Hub, and remove anything unexpected.
- Review the audit trail for the services that use Hub for login, such as your issue tracker and build server.
- If your Hub is internet facing, ask whether it needs to be, and place it behind a VPN or an access proxy where practical.
Why it matters
Hub is the place that decides who is an administrator for other tools. A flaw there is therefore more serious than the same flaw in one application: whoever controls Hub can reach the tools that trust it. The record describes a path from direct database access to administrative access, which is a missing authentication problem, CWE-306.
The wider lesson is about trust boundaries. A database that holds identity data should be reachable only from its service, and the service should not assume that a record found in the database proves the caller's identity.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan that matches the packages in a manifest against known CVEs.
Quick check
Is this an internet attack?
The vector says network, with no privileges and no interaction. The description mentions direct database access, so your exposure depends on your network layout. Treat it as urgent and update.
Sources
- JetBrains fixed security issues (named in the record)
- Safeguard Gold entry
Last reviewed: 19 October 2026.
