CVE-2026-86503 is a Server-Side Request Forgery (SSRF) vulnerability in JetBrains IntelliJ IDEA prior to version 2026.2.2. The vulnerability occurs when opening an untrusted project that triggers Kubernetes spec-source URL fetching, potentially allowing an attacker to induce the application to perform unintended network requests. The CVSS 3.1 base score is 3.3 (low), with attack vector local, low complexity, no privileges required, and user interaction required. The vulnerability impacts confidentiality but not integrity or availability.

An attacker who can convince a user to open a specially crafted untrusted project in IntelliJ IDEA before 2026.2.2 could exploit this SSRF vulnerability to cause the IDE to make network requests to arbitrary URLs. This could lead to limited information disclosure about internal network resources or other unintended network interactions. The impact is limited to confidentiality with no known integrity or availability effects. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should avoid opening untrusted projects until an official fix is available. Monitor JetBrains official channels for updates regarding a patch or mitigation steps.