CVE-2026-50242: JetBrains Hub authentication bypass via direct database access
CVE-2026-50242 affects JetBrains Hub and is described as an authentication bypass through direct database access that could lead to administrative access. The CNA rates it critical, and NVD lists a CVSS 3.1 base score of 9.8 with network attack vector and no privileges or user interaction required. No confirmed exploitation appears in the sources consulted, and the vendor advisory is the primary reference for remediation.
Overview
CVE-2026-50242 is a critical authentication bypass in JetBrains Hub. According to the record, an attacker able to reach the database directly could bypass authentication and obtain administrative access. The weakness is classified as CWE-306, missing authentication for a critical function.
Impact
The CNA describes the consequence as administrative access. The NVD base score is 9.8 (CVSS 3.1, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity and availability impact. The CNA itself lists a score of 10 under CVSS 3.1. The record does not state which of these scores applies in your environment.
Affected products and versions
The record lists Jetbrains Hub in the following ranges:
- From 2024.2.33606 up to but not including 2024.2.148429
- From 2024.3.44799 up to but not including 2024.3.148430
- From 2025.1.62455 up to but not including 2025.1.148120
- From 2025.2.86069 up to but not including 2025.2.148048
- From 2025.3.104432 up to but not including 2025.3.148033
- From 2026.1.12024 up to but not including 2026.1.13757
The fixed builds named in the description are 2026.1.13757, 2025.3.148033, 2025.2.148048, 2025.1.148120, 2024.3.148430 and 2024.2.148429. The record's fixes field is empty, so the vendor advisory should be consulted to confirm the fixed builds per branch.
Exploitation status
The CISA KEV catalog does not list this CVE in the record, so active exploitation is not confirmed by the sources consulted. No confirmed exploitation appears in the sources consulted.
Remediation and mitigation
- Upgrade JetBrains Hub to a build at or above the fixed version for your release branch, as stated in the vendor advisory.
- Restrict direct network access to the Hub database so that only the application can reach it.
- Review Hub administrator accounts and recent administrative changes for unexpected activity, especially on instances exposed to untrusted networks.
Detection guidance
- Monitor database connections to the Hub data store for sources other than the Hub application servers.
- Audit administrative role assignments and configuration changes in Hub logs for entries that cannot be traced to known operators.
Limitations of the available information
The record has no English title and no KEV, EPSS or SSVC data. The fixes list is empty. The description does not describe the exact database access path, and the only consulted reference is the vendor advisory page, whose contents were not part of this record.
Frequently asked questions
How severe is CVE-2026-50242?
The CNA rates it critical. NVD lists a CVSS 3.1 base score of 9.8, and the CNA lists 10 under the same version.
Is this CVE being actively exploited?
The CISA KEV catalog does not list it in the record, so no confirmed exploitation appears in the sources consulted.
Which versions are fixed?
The description names fixed builds for several branches, including 2026.1.13757 and 2025.3.148033. The record's fixes field is empty, so check the vendor advisory for your branch.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.