CVE-2026-86506: CWE-306 in JetBrains GoLand

CVE-2026-86506 describes a missing authentication vulnerability in JetBrains GoLand's profiler pprof server prior to version 2026.2.2.1. The lack of authentication on this injected server allows unauthorized access to profiling data, which could lead to information disclosure. The vulnerability is classified under CWE-306, indicating missing authentication for a critical function. The CVSS 3.1 base score is 5.9, reflecting a medium severity with network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and high confidentiality impact but no integrity or availability impact.

The vulnerability allows unauthenticated remote attackers to access profiling data from the GoLand profiler's pprof server. This exposure can lead to disclosure of sensitive information about the application's performance and internal state. There is no indication of impact on integrity or availability. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official patch or fix information is provided, users should monitor JetBrains advisories for updates. Until a fix is available, restricting network access to the profiler's pprof server or disabling the profiler when not in use may reduce exposure.