Compromised eMudhra certificates: update and verify JetBrains IDEs

Problem

JetBrains IDEs, Gateway and the Toolbox App older than the fixed versions trust compromised eMudhra certificates. The JetBrains security advisory describes the vulnerability: CVE-2026-91403 and CVE-2026-114820 in JetBrains Runtime, CVE-2026-118696 in the embedded browser and CVE-2026-118697 in jetbrainsd.

A vulnerability scanner can report CVE-2026-91403 against a file of the bundled runtime after the IDE update, for example for the runtime version 25.0.4.1. A scanner that matches the version number alone does not see the fix. The fixed runtime has the same version and a newer build. IntelliJ IDEA 2026.2.4 bundles JetBrains Runtime 25.0.4.1+1-b508.41, which contains the fix.

Cause

The private keys of eight eMudhra intermediate certificates are compromised. An attacker who can intercept network traffic can use them to impersonate the sites and services that the IDE connects to.

The IDE checks certificates against the trust store of its bundled JetBrains Runtime (JBR), not against the trust store of the operating system. An operating system update does not fix this vulnerability. The embedded browser (JCEF) and the jetbrainsd background service each have their own list of trusted certificates and need separate fixes.

Resolution

Check every IDE installation, including the IDE on a remote host that a remote development client connects to.

Update the IDE

The fixed versions of each product are listed in the advisory. Compare them with the version in the IDE's About dialog. The 2025.2.6 updates contain only the JBR fix. On these versions, also turn off the embedded browser as described below.

For an IDE installed with the Toolbox App, update the IDE in the Toolbox App. Update the Toolbox App itself to 3.8.2 or 3.9.1.

For a standalone installation:

1. Run the IDE's Check for Updates action.
2. Install the update.
3. Restart the IDE.

For Gateway, update to one of the fixed Gateway versions of the advisory.

Versions 2025.1 and earlier get no fix. Install a fixed version from the "Other versions" download page of the product, for example IntelliJ IDEA, other versions. The old installation still trusts the compromised certificates, so remove it when it is no longer needed. A perpetual fallback license covers its fallback version with all its minor releases, and all older versions (What is a perpetual fallback license).

When an update is not possible, follow the "If you can't update right away" section of the advisory. It covers the certificate cleanup, the embedded browser and a manual jetbrainsd update.

Check the bundled runtime

This check reads the trust store of the runtime inside the IDE installation. It does not check the embedded browser, jetbrainsd, or a custom trust store.

1. Run keytool from the runtime inside the IDE installation folder, without a filter. It must print a list of certificates. A wrong path or a keytool error prints no list.

   Windows, in Command Prompt (PowerShell does not run a quoted path without &):

   "<IDE folder>\jbr\bin\keytool.exe" -list -cacerts -storepass changeit
   

   macOS:

   "<IDE>.app/Contents/jbr/Contents/Home/bin/keytool" -list -cacerts -storepass changeit
   

   Linux:

   "<IDE folder>/jbr/bin/keytool" -list -cacerts -storepass changeit
   

2. Run the same command with a filter for the eMudhra roots. On Windows, add | findstr /i "emsign comodoaaa". On macOS and Linux, add | grep -i -E "emsign|comodoaaa". For a bundled runtime that contains the fix, the filter returns no matches.

On the builds without the fix that were tested, the filter prints comodoaaaca, emsigneccrootcag3, emsignrootcag1 and emsignrootcag2.

Check jetbrainsd

The jetbrainsd background service (What is jetbrainsd?) must be version 0.9.9728 or later. A fixed IDE or Toolbox App installs it when it starts, and one copy serves all JetBrains apps of a user. The certificate cleanup of the advisory does not fix jetbrainsd.

Windows, in PowerShell (| Out-String makes the version print before the next prompt):

& "$env:LOCALAPPDATA\JetBrains\Daemon\bundles\current\jetbrainsd\bin\jetbrainsd.exe" --version | Out-String

macOS:

"$HOME/Library/Application Support/JetBrains/Daemon/bundles/current/jetbrainsd.app/Contents/MacOS/jetbrainsd" --version

Linux:

"${XDG_DATA_HOME:-$HOME/.local/share}/JetBrains/Daemon/bundles/current/jetbrainsd/bin/jetbrainsd" --version

When the version is older, start an updated IDE or Toolbox App, or follow the manual jetbrainsd update of the advisory.

Turn off the embedded browser when required

In the fixed 2025.3 and later versions, the embedded browser downloads Chrome's certificate updates from Google's update servers shortly after the IDE starts. Turn off the embedded browser in these cases:

• The network blocks Google's update servers.
• The IDE runs a 2025.2 update.
• An unfixed IDE cannot be updated.

To turn it off:

1. Open Search Everywhere | Actions.
2. Type Registry.
3. Open Registry.
4. Find the ide.browser.jcef.enabled key.
5. Turn the key off.
6. Restart the IDE.

Features that use the embedded browser stop working, for example Markdown and HTML previews and Jupyter notebook output. Some plugins may not work correctly. Once a fixed 2025.3 or later IDE can reach Google's update servers, turn ide.browser.jcef.enabled back on. Restart the IDE.

After the update

Connections to a server whose certificate chains to one of the removed root certificates may fail. If this happens, the owner of that server must replace the certificate.

Project JDKs and tools with their own runtime, such as Node.js, Python or Go, use their own trust stores. Update them as their vendors recommend.