CVE-2026-123298: JetBrains Hub SMTP command injection

Summary

In JetBrains Hub before 2026.2.52556 sMTP command injection via email verification was possible

cve.now Index

9Pcve.now Index 9 of 100 · methodology v3 · provisional

Exploitation0/40No signal
Exposure3/25Reachable over the network · Unknown: No advisory context yet
Reach?/20Unknown. No tracked technology or package matched
Severity6/10CVSS 5.0, total technical impact per CISA
No patch0/5No signal

What would change the score

Would score about 64 if added to CISA KEV
Would score about 59 if CISA's SSVC rates exploitation active
Would score about 28 if advisories confirm default setups are exposed

How the score works · Leaderboard

What to do

Upgrade to a fixed version: 2026.2.52556.

Timeline

Nov 6, 2026, 10:27 AM UTCCVE published
Nov 6, 2026, 10:34 AM UTCFirst seen by cve.now
Nov 6, 2026, 2:26 PM UTCCISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
Nov 6, 2026, 2:42 PM UTCRecord last updated

Affected versions

JetBrains Hub
fixed in 2026.2.52556

Evidence 1

Link
jetbrains.com · privacy-security/issues-fixed

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

Questions about CVE-2026-123298

Is CVE-2026-123298 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data

Which versions are affected by CVE-2026-123298?

Hub: before 2026.2.52556.Source: cve.now feed data

How do I fix CVE-2026-123298?

Upgrade to a fixed version: 2026.2.52556.Source: cve.now feed data