Missing authentication exposes profiling data in JetBrains GoLand

In JetBrains GoLand before 2026.2.2.1 missing authentication on the GoLand profiler's injected pprof server exposed profiling data

• JetBrains GoLand: default status is unaffected; the semver range starting at 0 and less than 2026.2.2.1 is marked affected.
• 2026.2.2.1 is the supported fixed-release boundary. The available evidence does not independently verify later or parallel release branches, so this entry does not confirm their status.

The GoLand profiler temporarily instruments the profiled application and uses an injected pprof server to collect profiling data. The server did not enforce authentication, matching CWE-306, so a client that could reach it could retrieve profiling data without credentials. The supplied vector describes network reachability, no required privileges, no user interaction, and high attack complexity. The affected component is the profiler's injected server; the available evidence does not establish its bind address, port, endpoint set, or exact request sequence. The confirmed outcome is confidentiality loss of profiling data; integrity and availability impacts are not identified.

The supplied record describes network-based exploitation without prior privileges or user interaction, but with high attack complexity. An attacker still needs network reachability to the injected pprof server; the available evidence does not establish that every profiling session exposes it beyond the local host. The record does not identify a public exploit and does not provide a known exploitation status. The available sources do not name a campaign, victim, exploit code, or specific indicator.

Successful unauthenticated access can disclose profiling output from the targeted application. Depending on what the application exposes through profiling, that output may reveal call stacks, goroutines, resource-use patterns, and implementation details; the exact data content is deployment-dependent. The record supports confidentiality impact only and does not establish modification, code execution, or availability loss. The scope remains within the targeted profiling context, and access is limited by whether the injected server is reachable.

GoLand profiling data can include sampled call stacks, goroutine activity, CPU behavior, and memory or allocation information. Unauthorized disclosure may reveal sensitive implementation details or aid reconnaissance against the profiled application. The evidence does not establish impact to GoLand project files, source integrity, service availability, or arbitrary code execution. Practical exposure depends on whether the injected profiler server is reachable by an untrusted requester.

1. Upgrade JetBrains GoLand to 2026.2.2.1. This is the exact release boundary supported by the affected range and available patch metadata.
2. Until upgraded, prevent untrusted network access to profiled application processes and the injected pprof service using existing host or network controls. This is a risk-reduction precaution, not a confirmed vendor-specific workaround.
3. Inventory GoLand installations, profiler use, and active profiling sessions, then recheck the installed build after remediation. The available evidence does not provide a separate configuration switch or temporary vendor mitigation.

1. Inventory installed GoLand builds and compare them with the affected boundary in the affected-summary section.
2. Identify systems where the GoLand profiler was used, then determine whether its injected pprof server could be reached from outside the intended host or trust boundary.
3. Review available host, reverse-proxy, firewall, or application telemetry for unexpected requests to the profiler's pprof service during profiling sessions. No vendor-specific URI, log event, or IOC is established, so this is precautionary monitoring rather than a confirmed indicator.
4. Preserve and review any profiling artifacts or access records that may show unauthorized retrieval of profiles. The absence of matching log evidence does not prove that the system was not exposed.