CVE-2026-57922

No known exploitation. EPSS puts it in the 14th percentile. Fixed in 2026.2.16593.

CVSS 3.13.1Low EPSS percentile14th0.2% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known Fix2026.2.16593Upgrade to this build

Published 2026-06-26Updated 2026-06-27Sources: CVE.org, NVD

NVD CVE.org

What to do

Find your product and version, then upgrade to the build on the right.

JetBrains YouTrackAffected: < 2026.2.16593Upgrade to: 2026.2.16593Stated by: CVE record

Versions as the sources state them. Full version matrix after sign-in

Steps

Written by AI from the record

Check whether your YouTrack setup has the MCP interface enabled and is reachable from the network (including any externally accessible access path).
Verify your YouTrack version and compare it to the fix: update to YouTrack 2026.2.16593 or later.
If you can’t update immediately, restrict network access to the MCP interface so it’s not accessible from the public internet.
After updating, test that MCP connections still work for your intended users while remaining inaccessible from the public internet.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible

In plain language

Written by AI from the record

A security flaw in JetBrains YouTrack could let an attacker read some project settings through the MCP interface; most small businesses won’t be heavily impacted, but you should update if you use MCP/remote access.

In JetBrains YouTrack before 2026.2.16593, project settings could be disclosed over the network via the MCP interface (CWE-862), allowing an attacker to read configuration data.

If you're affected

Project configuration disclosure
Privacy risk for project data
Potential internal information exposure

What is it

Think of project settings like a company’s “internal instructions” for how projects are organized. This issue could allow a bad actor to peek at those instructions by using the MCP connection. It doesn’t directly change your data, but it can reveal information that shouldn’t be visible to outsiders.

Who is affected

This matters if you run JetBrains YouTrack and use the MCP interface in a way that’s reachable over the network. The risk depends on whether attackers can access MCP from where they are located; exact reachability in the default configuration isn’t confirmed in the findings. It’s only a concern if MCP is enabled and accessible in your environment (for example, not locked down to trusted networks/users).

How urgent is it

This is a GREEN issue: it has a low severity and there’s no confirmed public exploit code on record. The main reason it’s still worth fixing is that it can expose project settings via MCP over the network. If you use MCP and it’s network-reachable, update to the fixed version promptly, but this is not an emergency for businesses that don’t expose MCP.

What to do — in detail

Confirm whether you’re exposed

Determine whether your YouTrack instance has the MCP interface enabled/used.
Check how MCP is exposed:
- Is it reachable from the public internet?
- Is it only reachable from trusted internal networks/VPNs?
- Are there any firewall rules or reverse-proxy routes that allow inbound MCP access?

Check your version

Identify your current YouTrack version.
If it is earlier than 2026.2.16593, you are in the affected range described by the findings.

Upgrade to the fix

Upgrade YouTrack to 2026.2.16593 (the findings list this as the fixed version).

Temporary workaround if patching is delayed

Lock down network access to the MCP interface so it is not reachable from the public internet.
Ensure only the systems/users that genuinely need MCP can reach it (for example, via internal network access controls/VPN and strict firewall rules).

What to monitor after the change

Confirm MCP is still functional for your intended workflow.
Look for unusual connection attempts targeting the MCP endpoint (especially from non-trusted IP ranges), if you have network logging available.

KEV / exploitation status

This CVE is not listed in CISA KEV, and there is no public exploit code on record in the provided findings.

Technical context

Severity and likelihood: The provided CVSS score is LOW and the traffic-light verdict is GREEN. The findings indicate the weakness is CWE-862 (missing authorization / authorization bypass leading to information disclosure). The attack vector is network-based and user interaction is none.

Mechanism: An attacker could disclose project settings in JetBrains YouTrack through the MCP interface. Authentication requirements are described as low in the findings, but exact preconditions and whether it is reachable in a default configuration are not specified.

Exploitation status: Not listed in CISA KEV and no public exploit code was found in the provided findings. EPSS is reported as 0.1% with a flat trend, but the decisive public-exploitation evidence is the lack of KEV listing and no exploit code on record.

Fix: YouTrack is fixed in 2026.2.16593.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS14th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.2% chance of exploitation activity in the next 30 days, which ranks it in the 14th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

6 events over 5 days, from the signal feeds we watch.

2026-07-01OpenVAS check added
2026-06-27Patch availablerecord updated
2026-06-26Publishedweakness classified, att&ck mapped

Affected products

JetBrainscommercial · CZaka intellij idea, youtrack, teamcity
- YouTrackDesktop AppOn-premDevTools & CI / ide-editor

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Scored 3.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality LowSome restricted information is disclosed, but limited in scope
Integrity NoneNo integrity impact
Availability NoneNo availability impact