CVE-2026-86492
In JetBrains YouTrack before 2026.2.18634 a shared token cache allowed cross-tenant theft of GitHub App installation tokens
Scoring
- Severity
- HIGH
- CVSS base score
- 8.5
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
- EPSS probability
- 0.56%
- CWE
- CWE-488
- Published
- 2026-09-07
- Last modified
- 2026-09-08
Affected products
- JetBrains YouTrack
Weakness type
Related vulnerabilities
- CVE-2026-84685 — Improper Cache Isolation in auth0/react-native-auth0 SDK Web Platform Credential Management
- CVE-2026-18489 — IBM ContextForge Translate is affected by cross-client credential context confusion
- CVE-2026-82367 — Re-entrant synchronous publish in AshGraphql subscription batcher delivers one subscriber's records to another's topic
- CVE-2026-71850 — Hono: `memo()` retains SSR output across requests, leading to cross-user data disclosure
- CVE-2026-16326 — consul-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
- CVE-2026-16498 — terraform-mcp-server vulnerable to cross-tenant credential reuse in streamable-HTTP stateless mode
- CVE-2026-54497 — view_component: Reused Component Instances Retain Stale Render Context
- CVE-2026-14621 — FederatedAI FATE OSX Broker QueuePushReqStreamObserver.java QueuePushReqStreamObserver.initEggroll wrong session