CVE-2026-57926 is a low severity flaw (CVSS 2.6) in JetBrains YouTrack. Before version 2026.2.16593, the websandbox bridge was vulnerable to a prototype pollution attack. The fix is to upgrade self-hosted servers to 2026.2.16593 or later, as part of routine patching.
What's affected
- JetBrains YouTrack before 2026.2.16593.
- Fixed version: 2026.2.16593.
How to check if you're exposed
YouTrack Cloud is managed by JetBrains, so the check applies to self-hosted installs. Open the administration area of your YouTrack server and read the build number. If it is lower than 2026.2.16593, plan the upgrade.
Safeguard does not replace the vendor advisory for packaged software like this, but the Gold directory is a quick place to look up the CVE record and see related advisories. If your own code bundles components from this product family, the free scan at gold.safeguard.sh/scan can list them.
What to do now
- Upgrade self-hosted YouTrack to 2026.2.16593 or later.
- Check the JetBrains fixed issues page for the full list of changes in that release.
After the update, confirm the new version in the product itself, then repeat the check on every environment, including staging and disaster recovery copies. Those copies are the ones most often left behind, and an old copy on a reachable network is still an open door.
Why it matters
CWE-1321 (Prototype Pollution) describes code that lets an attacker alter the shared prototype of JavaScript objects. Other code then reads the altered values. The record scores this low because it needs a logged in user, user interaction, and high attack complexity, and it only affects integrity at a low level.
The CISA KEV flag is false.
A low score is not a reason to skip a fix, only a reason to schedule it sensibly. Keep a note of the version you moved to so the next audit has an answer.
Quick check
Is this urgent?
No. The score is 2.6. Fold it into your normal upgrade cycle unless your policy says otherwise.
Sources
Last reviewed: 19 October 2026.
