Missing authentication in JetBrains PyCharm Jupyter MCP tools enables local code execution

In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools

• JetBrains PyCharm: affected from 0 with an upper bound of less than 2026.2.1 under semver. The product record sets the default status outside this declared affected range to unaffected.
• The record identifies no additional PyCharm branches, editions, packages, or deployment modes. It does not independently validate the status of any parallel or separately packaged branch beyond the supplied range.

The weakness is classified as CWE-306, missing authentication for a critical function. The affected component is the Jupyter MCP tooling exposed through PyCharm's integrated MCP Server; JetBrains documentation describes that plugin as bundled and enabled by default and lists Jupyter notebook tools among the available tools. At a high level, an attacker-controlled unauthenticated invocation of a Jupyter MCP tool could reach a code-execution-capable operation. The record characterizes the path as local, requiring no prior privileges or user interaction and having low complexity. It does not identify the exact tool, request format, transport, listening interface, process boundary, or execution primitive, so those implementation details remain unknown. The stated scope is unchanged, meaning the documented impact is within the security authority of the affected PyCharm process rather than an established cross-security-domain escape.

The supplied attack characterization is local: an attacker must reach the affected PyCharm tooling on the same host or within a local execution context; a remote network path is not established. It requires no authenticated privileges and no user interaction, and the assessed complexity is low. The normalized record marks public exploit as false and does not mark the issue as known exploited. CISA enrichment records exploitation as none and automatable as no for its assessment. These status fields do not prove that abuse has never occurred outside that reporting scope.

Exploitation can result in code execution in the security context available to PyCharm. That can affect the confidentiality, integrity, and availability of local projects and other resources exposed to the process, including possible disclosure, modification, or deletion of data. The record does not establish that the flaw grants operating-system administrator rights, escapes a sandbox, or reaches other machines, so those outcomes should not be assumed. Operationally, a compromised developer workstation could interrupt builds, analysis, or notebook work and require review of code integrity and credentials that may have been accessible to the PyCharm process.

Successful code execution could let an attacker act with the permissions of the PyCharm process. Possible consequences include reading or changing project source, local notebooks, build settings, or other data accessible to that process, and disrupting development work. The record supports serious confidentiality, integrity, and availability consequences, but it does not identify a confirmed data theft, persistence mechanism, privilege escalation, or compromise of another host. The local reachability described in the record limits the stated exposure to systems where an attacker can reach the affected local tooling.

1. Upgrade affected JetBrains PyCharm installations to 2026.2.1, the exact upper boundary in the CNA affected data. Do not infer coverage for later or parallel branches that are not separately listed.
2. Inventory workstations for PyCharm, inspect whether the MCP Server plugin and Jupyter tools are enabled, and prioritize systems in the affected range.
3. If immediate update is not possible, temporarily disable the MCP Server plugin or MCP Server setting where operationally acceptable, and restrict local access to the workstation. This is a precaution based on documented controls, not a vendor-confirmed substitute for the update.

1. Enumerate installed PyCharm deployments and compare each installation with the affected range; record the exact semver and deployment context.
2. Check PyCharm's Plugins settings for the MCP Server plugin and Settings | Tools | MCP Server to determine whether the server is enabled; note whether Jupyter notebook tools are in use. These checks identify exposure conditions, not compromise.
3. Review endpoint telemetry around suspicious activity for PyCharm process launches, unexpected child processes, unexpected reads or modifications of project or notebook files, and unusual local client interactions with the MCP service. Treat these as precautionary review areas, not vendor-defined indicators.
4. If suspicious activity is found, compare project and notebook content with trusted versions and investigate process and credential access available to the PyCharm context.
5. The record provides no log event names, ports, file paths, payloads, or IOCs; absence of matching telemetry does not prove that the system was not exposed or compromised.