In JetBrains Toolbox App before 2.6 unencrypted credential transmission during SSH authentication was possible

The primary impact of CVE-2025-43013 is the potential exposure of SSH credentials. An attacker positioned on the network or intercepting traffic could capture these credentials in transit. Successful capture would grant the attacker access to systems authenticated via SSH, potentially leading to unauthorized access, data breaches, and lateral movement within the network. The severity is amplified if the SSH keys used provide access to sensitive systems or data. While not directly exploitable for remote code execution, the compromised credentials could be used to escalate privileges and compromise other systems.

1. Gereserveerd2025-04-16
2. Gepubliceerd2025-04-17
3. EPSS bijgewerkt2026-03-23

The primary mitigation for CVE-2025-43013 is to upgrade the JetBrains Toolbox App to version 2.6 or later. If an immediate upgrade is not feasible due to compatibility issues or testing requirements, consider implementing network segmentation to limit the potential blast radius of a compromised credential. Additionally, enforce multi-factor authentication (MFA) on SSH access to add an extra layer of security, even if credentials are intercepted. Monitor network traffic for suspicious SSH activity, particularly unusual connection attempts or large data transfers. After upgrading, confirm the fix by attempting an SSH authentication and verifying that credentials are no longer transmitted in plain text using a network packet analyzer.