First day on Intigriti: our agent harness found and proved a remote code execution bug in Odoo's program.

CVE-2026-123278

MediumCVSS 6.7/10Last modified Nov 10, 2026

Description

In JetBrains IntelliJ IDEA before 2026.3 code execution was possible via the unauthenticated JDBC worker RMI endpoint

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

Affected software

Vendor	Product	Versions
JetBrains	IntelliJ IDEA	< 2026.3

References

https://www.jetbrains.com/privacy-security/issues-fixed/Vendor Advisory

Timeline

Published: Nov 6, 2026
Last modified: Nov 10, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-1232799.0In JetBrains Datalore before 2026.4 code execution was possible in a notebook's computation by view-only collaborators CVE-2026-123288.1Memory safety bugs present in Firefox ESR 115.36, Firefox ESR 140.11, Thunderbird ESR 140.11, Firefox 151 and Thunderbird 151. Some of these CVE-2026-1232808.1In JetBrains Datalore before 2026.2.4 unauthenticated users could execute code via published interactive reports CVE-2026-1232817.5In JetBrains Datalore before 2026.4 notebook code could execute commands in the sidecar container via the mount broker CVE-2026-1232827.4In JetBrains Datalore before 2026.4 missing expiration validation of account tokens allowed a new authenticated session CVE-2026-1232836.8In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account CVE-2026-1232846.5In JetBrains Datalore before 2026.4 improper authorisation on workspace moves allowed view-only collaborators to modify shared content CVE-2026-1232858.8In JetBrains Datalore before 2026.3 command execution was possible in the database task container via JVM options injection CVE-2026-1232866.5In JetBrains Datalore before 2026.4 improper authorisation allowed read the notebook owner's file storage session token CVE-2026-1232877.5In JetBrains Datalore before 2026.4 private notebook files could be downloaded without authentication via published interactive reports CVE-2026-1232885.4In JetBrains Datalore before 2026.4 stored XSS in notebook charts was possible via Vega editor link CVE-2026-1232894.3In JetBrains Datalore before 2026.4 improper authorisation allowed notebook viewers to modify files

CVE-2026-123278: Medium severity, CVSS 6.7 | Vulnix