JetBrains Teamcity
Don't miss out!
Thousands of developers use stack.watch to stay informed.Get an email whenever new security vulnerabilities are reported in JetBrains Teamcity.
Known Exploited JetBrains Teamcity Vulnerabilities
The following JetBrains Teamcity vulnerabilities have been marked by CISA as Known to be Exploited by threat actors.
| Title | Description | Added |
|---|---|---|
| JetBrains TeamCity Deserialization of Untrusted Data Vulnerability |
JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol. CVE-2026-63077 Exploit Probability: 94.9% |
August 5, 2026 |
| JetBrains TeamCity Relative Path Traversal Vulnerability |
JetBrains TeamCity contains a relative path traversal vulnerability that could allow limited admin actions to be performed. CVE-2024-27199 Exploit Probability: 100.0% |
April 20, 2026 |
| JetBrains TeamCity Authentication Bypass Vulnerability |
JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions. CVE-2024-27198 Exploit Probability: 99.9% |
March 7, 2024 |
| JetBrains TeamCity Authentication Bypass Vulnerability |
JetBrains TeamCity contains an authentication bypass vulnerability that allows for remote code execution on TeamCity Server. CVE-2023-42793 Exploit Probability: 100.0% |
October 4, 2023 |
Of the known exploited vulnerabilities above, 4 are in the top 1%, or the 99th percentile of the EPSS exploit probability rankings.
By the Year
In 2026 there have been 27 vulnerabilities in JetBrains Teamcity with an average score of 7.2 out of ten. Last year, in 2025 Teamcity had 48 security vulnerabilities published. Right now, Teamcity is on track to have less security vulnerabilities in 2026 than it did last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 1.18.
| Year | Vulnerabilities | Average Score |
|---|---|---|
| 2026 | 27 | 7.24 |
| 2025 | 48 | 6.06 |
| 2024 | 65 | 6.30 |
| 2023 | 35 | 6.36 |
| 2022 | 29 | 6.64 |
| 2021 | 37 | 6.52 |
| 2020 | 18 | 5.87 |
| 2019 | 20 | 6.10 |
It may take a day or so for new Teamcity vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.
Recent JetBrains Teamcity Security Vulnerabilities
TeamCity <2026.2 Stored XSS in Classic Build Log
CVE-2026-111096
6.7 - Medium
- October 15, 2026
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible
XSS
JetBrains TeamCity <2026.2 RCE via Build Msg Protocol Whitelist Bypass
CVE-2026-111094
8.1 - High
- October 15, 2026
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
Marshaling, Unmarshaling
TeamCity <2026.2 Stored XSS in Classic Project Overview
CVE-2026-111095
8 - High
- October 15, 2026
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible
XSS
JetBrains TeamCity <2026.2.1 Git Submodule URL Validation Bypass
CVE-2026-106219
6.5 - Medium
- October 06, 2026
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
External Control of File Name or Path
TeamCity < 2026.1.3 Kotlin DSL Sandbox Escape (RCE)
CVE-2026-106218
8.8 - High
- October 06, 2026
In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
Denylist / Deny List
JetBrains TeamCity <2026.2 admin takeover via password reset
CVE-2026-100255
8.1 - High
- September 30, 2026
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset
Improper Validation of Unsafe Equivalence in Input
JetBrains TeamCity <2026.2 sandbox escape via Kotlin DSL assigner
CVE-2026-100253
8.8 - High
- September 30, 2026
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL
Denylist / Deny List
TeamCity <2026.2 Windows command exec via CRLF injection in Git pipeline
CVE-2026-100254
8.8 - High
- September 30, 2026
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings
Shell injection
JetBrains TeamCity <2026.1.3 Remote Code Execution via Agent Polling
CVE-2026-63077
9.8 - Critical
- July 27, 2026
In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
Marshaling, Unmarshaling
TeamCity <2026.1.2 Git VCS CodeExec Vulnerability
CVE-2026-65907
9.1 - Critical
- July 23, 2026
In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
Code Injection
TeamCity RCE via Kotlin DSL sandbox escape before 2026.1.2/2025.11.6
CVE-2026-65906
8.8 - High
- July 23, 2026
In JetBrains TeamCity before 2026.1.2, 2025.11.6 ode execution via Kotlin DSL sandbox escape was possible
Code Injection
JetBrains TeamCity <2026.1.2: Pipeline Mod via Improper Perm Checks
CVE-2026-59796
8.1 - High
- July 10, 2026
In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks
AuthZ
TeamCity XSS via unauth agent reg before 2026.1.2 (JetBrains)
CVE-2026-59795
8.1 - High
- July 10, 2026
In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible
XSS
JetBrains TeamCity <2026.1.2 XSS via Agent Reported Data on Cloud Profile
CVE-2026-59794
7.3 - High
- July 10, 2026
In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data
XSS
TeamCity < 2026.1.2 Perforce VCS arbitrary file access
CVE-2026-59793
8.8 - High
- July 10, 2026
In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration
External Control of File Name or Path
TeamCity XSS via Stored SAML login before 2026.1
CVE-2026-49381
3.4 - Low
- May 29, 2026
In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible
XSS
JetBrains TeamCity <2026.1 SAML Plugin Open Redirect
CVE-2026-49380
3.1 - Low
- May 29, 2026
In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible
Open Redirect
Thread Names Assigner Exposes Credentials in JetBrains TeamCity <2026.1
CVE-2026-49379
6.5 - Medium
- May 29, 2026
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
Insufficiently Protected Credentials
JetBrains TeamCity <=2026.1 Credential Exposure via Autocomplete
CVE-2026-49378
4.3 - Medium
- May 29, 2026
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion
AuthZ
JetBrains TeamCity <=2025.11.1 Default Agent Params expose sensitive data
CVE-2026-49377
4.3 - Medium
- May 29, 2026
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
Exposure of Sensitive Information Through Environmental Variables
TeamCity<2026.1 Insufficient Username Validation in SAML Plugin Assigner
CVE-2026-49376
6.5 - Medium
- May 29, 2026
In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
AuthZ
JetBrains TeamCity <2026.1 Reflected XSS on Repo Download Page
CVE-2026-49375
6.1 - Medium
- May 29, 2026
In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page
XSS
TeamCity <2026.1 Improper Perm Checks Expose Config Params
CVE-2026-49374
7.6 - High
- May 29, 2026
In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters
AuthZ
JetBrains TeamCity <2026.1 RCE via Perforce Connector
CVE-2026-49373
7.1 - High
- May 29, 2026
In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings
Argument Injection
JetBrains TeamCity <2026.1 SSRF via Build Status (2025.11.5)
CVE-2026-49372
7.5 - High
- May 29, 2026
In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible
SSRF
JetBrains TeamCity 2026.1.0 Reflected XSS in Keyword Filter
CVE-2026-49371
7.1 - High
- May 29, 2026
In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible
XSS
TeamCity API Unauthorized Access before 2026.1 (JetBrains)
CVE-2026-44413
8.2 - High
- May 11, 2026
In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access
Missing Authentication for Critical Function
TeamCity Reflected XSS (Storage Settings) before 2025.11.1
CVE-2025-68268
5.4 - Medium
- December 16, 2025
In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page
XSS
JetBrains TeamCity < 2025.11.1: GitHub PA Token Stored Privilege Escalation
CVE-2025-68267
6.5 - Medium
- December 16, 2025
In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token
Least Privilege Violation
JetBrains TeamCity <=2025.10 DOM XSS on OAuth Connections Tab
CVE-2025-68166
5.4 - Medium
- December 16, 2025
In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab
XSS
JetBrains TeamCity pre-2025.11: VCS Root setup Reflected XSS
CVE-2025-68165
5.4 - Medium
- December 16, 2025
In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup
XSS
JetBrains TeamCity Port Enumeration via Perforce Conn Test (pre-2025.11)
CVE-2025-68164
2.7 - Low
- December 16, 2025
In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test
Side Channel Attack
TeamCity <2025.11: stored XSS on agentpushInstall page
CVE-2025-68163
3.5 - Low
- December 16, 2025
In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page
XSS
TeamCity <2025.11: Maven Embedder allows Unrestricted Extension Loading
CVE-2025-68162
2.7 - Low
- December 16, 2025
In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration
Inclusion of Functionality from Untrusted Control Sphere
TeamCity < 2025.11 Path Traversal via File Upload (CVE-2025-67742)
CVE-2025-67742
3.8 - Low
- December 11, 2025
In JetBrains TeamCity before 2025.11 path traversal was possible via file upload
Directory traversal
JetBrains TeamCity 2025.10 Stored XSS via session attribute
CVE-2025-67741
4.8 - Medium
- December 11, 2025
In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute
XSS
JetBrains TeamCity <2025.11: Improper Access Control Exposes GH Token Metadata
CVE-2025-67740
2.7 - Low
- December 11, 2025
In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata
AuthZ
JetBrains TeamCity <2025.11.2 Rp URL Validation flaw => Local Path Disclosure
CVE-2025-67739
3.1 - Low
- December 11, 2025
In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure
Improper Authorization in Handler for Custom URL Scheme
TeamCity < 2025.07.2 Git URL Validation Flaw Causing Credential Leak on Windows
CVE-2025-59457
7.7 - High
- September 17, 2025
In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows
Allowlist / Allow List
JetBrains TeamCity <2025.07.2 PT on Project Archive Upload
CVE-2025-59456
5.5 - Medium
- September 17, 2025
In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload
Relative Path Traversal
JetBrains TeamCity Project Isolation Bypass (Race Cond.)
CVE-2025-59455
4.2 - Medium
- September 17, 2025
In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition
Race Condition
JetBrains TeamCity <2025.07.1> Privilege Escalation via Wrong Dir Ownership
CVE-2025-57732
- August 20, 2025
In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership
Improper Ownership Management
TeamCity <2025.07.1 – SMTP Injection via email component
CVE-2025-57733
- August 20, 2025
In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content
Command Injection
TeamCity <2025.07.1: AWS Creds Leak in Docker Scripts
CVE-2025-57734
- August 20, 2025
In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files
Insertion of Sensitive Information into Externally-Accessible File or Directory
TeamCity before 2025.07: Improper Access Control Exposes VCS Build Settings
CVE-2025-54533
- July 28, 2025
In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration
AuthZ
TeamCity <=2025.07 Improper Access Control - Disclosure of Build Settings
CVE-2025-54532
- July 28, 2025
In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies
AuthZ
TeamCity <=2025.07 Reflected XSS on agentpushPreset
CVE-2025-54534
- July 28, 2025
In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page
XSS
JetBrains TeamCity <2025.07 Weak Hashing of Reset/Verify Tokens
CVE-2025-54535
7.5 - High
- July 28, 2025
In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms
Reversible One-Way Hash
TeamCity <=2025.07: Credentials stored in plain text in memory snapshots
CVE-2025-54537
- July 28, 2025
In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots
Cleartext Storage of Sensitive Information
TeamCity before 2025.07: Password Exposure via hg pull command line
CVE-2025-54538
- July 28, 2025
In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command
Cleartext Storage of Sensitive Information
Stay on top of Security Vulnerabilities
Want an email whenever new vulnerabilities are published for JetBrains Teamcity or by JetBrains? Click the Watch button to subscribe.
