CVE-2026-111091: an untrusted project's MCP server config could run code in JetBrains Junie CLI

Vulnerability · JetBrains Junie CLI · HIGH

Incident dateNot stated

DisclosedOct 15, 2026 (JetBrains Fixed security issues page and CVE-2026-111091). Fix released Aug 3, 2026 in Junie CLI 26.8.3.

Added hereOct 15, 12:45 PM ET

Last verifiedOct 15, 2026

Summary

JetBrains published CVE-2026-111091 on Oct 15, 2026 for Junie CLI, its standalone AI coding agent. JetBrains says that before version 26.8.3, code execution was possible through an untrusted project's MCP server configuration. JetBrains rates it High, CVSS 3.1 7.8, and credits the report to syaifmax (JUNIE-3056). The fix shipped in Junie Release 26.8.3 on Aug 3, 2026, whose release notes say JetBrains added project trust verification before loading MCP servers, skills, commands and project configuration. This is a disclosure of an already-fixed issue. JetBrains has not published technical details, and no exploitation has been reported.

Severity

HIGH High (CVSS 3.1 7.8, JetBrains as CNA; local attack vector, user interaction required). The victim has to open an attacker-controlled project with Junie CLI. Fixed in 26.8.3 since Aug 3, 2026. No exploitation reported.

Timeline

Aug 3, 2026
JetBrains publishes Junie Release 26.8.3 (build 2548.5) on GitHub, adding project trust verification before loading MCP servers, skills, commands and project configuration.
Oct 15, 2026
JetBrains lists the issue on its Fixed security issues page and publishes CVE-2026-111091 (NVD record published 16:17 UTC).

How it happened

Junie CLI reads MCP server definitions from a .junie/mcp/mcp.json file at the project or user level, and its docs say servers imported from that file are enabled by default. A project-level file can be committed to a repository. JetBrains' description says only that code execution was possible via an untrusted project's MCP server configuration; it does not give the exact steps. The 26.8.3 release notes say JetBrains added a project trust check before Junie loads MCP servers, skills, commands and project configuration. JetBrains' current docs say interactive launches ask you to trust a project first, but non-interactive runs (one-shot prompts, piped input, ACP and Gateway) are trusted by design and load the project's Junie configuration without prompting. JetBrains lists the weakness as CWE-829 (inclusion of functionality from an untrusted control sphere).

How to check your app

Update Junie CLI to 26.8.3 or later (current releases are well past that).
Before running Junie in a cloned repository, look at its .junie folder, especially .junie/mcp/mcp.json.
Only run Junie non-interactively (CI, one-shot prompts, ACP, Gateway) in projects you trust, as JetBrains advises.

Sources

Corrections and updates

None. Re-checked against every source on Oct 15, 2026.