JetBrains on October 30, 2026 told users of its IDEs, ReSharper, the Toolbox App and Gateway to update right away after the private keys behind eight eMudhra intermediate certificates were exposed. A second advisory published the same day tracks the wider fallout across TeamCity, YouTrack, Hub, Qodana, Kotlin tooling and other JetBrains products.
The risk is a network attacker who can sit between a developer and a server. With the leaked keys, that attacker could mint certificates that a JetBrains tool would accept as genuine. Because the IDEs ship their own Java runtime and certificate list, patching the operating system alone does not close the gap.
What happened with eMudhra
According to JetBrains, a security researcher reported on October 17, 2026 that weak key generation made it possible to recover the keys of eight eMudhra intermediate CAs. Anyone holding those keys can produce certificates that chain up to a trusted root.
Browser and operating system makers have already blocked the affected chains. Applications that carry a private trust store, which includes most Java software, need their own updates. JetBrains says it has seen no exploitation against its customers so far.
Which JetBrains products are affected
The IntelliJ-based IDEs check certificates against the store inside JetBrains Runtime (JBR), the company's own Java build. The embedded Chromium browser (JCEF) used for previews has a separate list, and a background helper called jetbrainsd keeps a third list compiled into the binary. All three needed fixes.
- JBR: JetBrains merged Oracle's Java fixes for CVE-2026-91403 and CVE-2026-114820. The new runtime blocks the bad intermediates and stops trusting four roots: the three emSign roots (ECC G3, G1 and G2) plus AAA Certificate Services.
- Embedded browser: In fixed builds from 2025.3 onward, JCEF fetches Chrome's certificate blocklist from Google soon after the IDE opens (CVE-2026-118696).
- jetbrainsd: Fixed in version 0.9.9728 (CVE-2026-118697). Each user runs a single instance, and a newer release takes over from an older one.
Fixed versions to install
For most people, moving to the newest bugfix build of the release line already in use is enough. JetBrains lists these patched builds, among others:
- IntelliJ IDEA, PyCharm, PhpStorm, WebStorm, RubyMine and GoLand: 2026.2.4 and 2026.3 RC, with patched builds also for the 2026.1, 2025.3 and 2025.2 lines.
- DataGrip: 2026.2.6.1, 2026.1.4.1, 2025.3.6.1, 2025.2.6.1 and 2026.3 RC.
- CLion 2026.2.4.1, RustRover 2026.2.5, and Rider and ReSharper 2026.2.4.
- Toolbox App 3.9.1 or 3.8.2, and Gateway 2026.2.4, 2026.1.4, 2025.3.3 or 2025.2.6.
Two limits matter. IDE releases 2025.1 and older, plus Toolbox App 3.7 and older, get no patch, so those users must move to a supported line. The 2025.2.6 builds carry only the runtime fix for now, and a later hotfix will cover the embedded browser.
Servers, build agents and other tools
The status advisory lists YouTrack Server 2026.2.19728, 2026.1.14165 and 2025.3.172487, Hub 2026.2.52556, Datalore 2026.4.1, Qodana Self-Hosted 1.49.0 and Junie CLI 26.10.27 as fixed. Work is still under way for TeamCity, Kotlin tooling, IDE Services, MPS and the Qodana linter images and CLI.
For TeamCity, JetBrains warns that upgrading the product may leave the old Java in place. Admins should inspect the Java version on each server node and each agent, and that also covers agents a TeamCity Cloud customer hosts. Kotlin/JS and Kotlin/Wasm builds should pin Node.js 24.22.1 or newer until the next Gradle plugin ships.
What it means for developers
This is a good reminder that a Java desktop tool does not share the trust settings of the machine it runs on. A clean OS update can leave an IDE, a CI agent or a database client still trusting a revoked authority.
Anyone running Java services of their own, including JDBC apps that connect to Oracle or PostgreSQL over TLS, should check which JDK they use and whether it has the October trust store changes.
Database developers who live in DataGrip or IntelliJ's database tools should update first, since those tools open many TLS connections to remote hosts. After updating, a server whose chain ends at one of the removed roots will fail to connect, and its owner must reissue the certificate. Do not work around that by accepting untrusted certificates.
If you cannot update yet
JetBrains describes a reversible stopgap that takes a few minutes. Copy the cacerts file from the IDE's bundled runtime to your home folder and delete the AAA Certificate Services and emSign ECC Root CA - G3 entries from the copy with keytool. Then point the IDE to that file through a custom VM option and restart.
Use a full path with no shortcuts, because a wrong path quietly leaves you exposed. Also confirm that automatic acceptance of untrusted certificates is off under Settings, Tools, Server Certificates, and update the ca-certificates package on Linux.
The embedded browser cannot be cleaned this way, so turn it off through the registry key ide.browser.jcef.enabled until you update. Markdown preview, Jupyter output and some plugins will stop working while it is off. Updating any fixed JetBrains app also refreshes jetbrainsd for every installed IDE.
Conclusion
The eMudhra key exposure reaches well past web browsers, and JetBrains users need to act on their own. Update every IDE, the Toolbox App and Gateway today, check the Java runtime on CI servers and agents, and keep watching the JetBrains status advisory for TeamCity and Kotlin fixes still in progress.
Sources
- JetBrains Security Blog: Compromised eMudhra Certificates, Update Your JetBrains IDEs, ReSharper, .NET Tools, Toolbox App, and Gateway Now
- JetBrains Security Blog: eMudhra Certificate Authority Incident, Status and Guidance for JetBrains Products
See my articles more often when you search Google.
