Actively exploited in the wild
JetBrains TeamCity Authentication Bypass Vulnerability
JetBrains - TeamCity · Listed in the CISA KEV since 2023-10-04. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2023-42793
CriticalCVSS 9.8KEVSummary
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible.
Risk Assessment
An attacker can bypass authentication and execute arbitrary code on the TeamCity server, potentially leading to control over CI/CD processes and source code.
Recommendation
Upgrade TeamCity to version 2023.05.4 or later. Restrict access to the TeamCity server to trusted users and networks only.
Other vulnerabilities in JetBrains TeamCity
See all- CVE-2026-44413High
In JetBrains TeamCity versions before 2026.1 and 2025.11.5, authenticated users could expose the server API to unauthorized access.
- CVE-2026-63077CriticalActively exploited
In JetBrains TeamCity before versions 2026.1.3 and 2025.11.7, unauthenticated remote code execution is possible via the agent polling protocol.
- CVE-2026-65907Critical
In JetBrains TeamCity before 2026.1.2 and 2025.11.6, code execution in Git VCS roots was possible.
- CVE-2024-27198CriticalActively exploited
In JetBrains TeamCity before 2023.11.4, an authentication bypass vulnerability exists that allows performing admin actions without authorization.
- CVE-2023-41249Medium
In JetBrains TeamCity versions before 2023.05.3, reflected XSS was possible during copying Build Step.
- CVE-2023-34225Medium
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the NuGet feed page.
- CVE-2023-34220Medium
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the Commit Status Publisher window.
- CVE-2023-34218Critical
In JetBrains TeamCity before version 2023.05, it was possible to bypass permission checks, allowing for the execution of admin actions.
- CVE-2026-65906High
In JetBrains TeamCity before versions 2026.1.2 and 2025.11.6, code execution was possible via Kotlin DSL sandbox escape.
- CVE-2026-59796High
In JetBrains TeamCity before version 2026.1.2, a vulnerability was found that allows pipeline modification due to improper permission checks.
Original NVD description (English source)
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible