CVE-2026-106218
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
In JetBrains TeamCity before versions 2026.1.3 and 2025.11.7, a Kotlin DSL sandbox escape leading to remote code execution (RCE) on the server was possible. The vulnerability allows an attacker to execute arbitrary code in the context of the TeamCity server.
Risk Assessment
Remote code execution on a CI/CD server can allow an attacker to take control of the build infrastructure, steal credentials, modify artifacts, or deploy malicious software to production environments.
Recommendation
Immediately update JetBrains TeamCity to version 2026.1.3 or 2025.11.7 (or later). Restrict access to the TeamCity server to trusted networks and verify that no unauthorized access has occurred.
Other vulnerabilities in JetBrains TeamCity
See all- CVE-2026-44413High
In JetBrains TeamCity versions before 2026.1 and 2025.11.5, authenticated users could expose the server API to unauthorized access.
- CVE-2026-63077CriticalActively exploited
In JetBrains TeamCity before versions 2026.1.3 and 2025.11.7, unauthenticated remote code execution is possible via the agent polling protocol.
- CVE-2026-65907Critical
In JetBrains TeamCity before 2026.1.2 and 2025.11.6, code execution in Git VCS roots was possible.
- CVE-2024-27198CriticalActively exploited
In JetBrains TeamCity before 2023.11.4, an authentication bypass vulnerability exists that allows performing admin actions without authorization.
- CVE-2023-42793CriticalActively exploited
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible.
- CVE-2023-41249Medium
In JetBrains TeamCity versions before 2023.05.3, reflected XSS was possible during copying Build Step.
- CVE-2023-34225Medium
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the NuGet feed page.
- CVE-2023-34220Medium
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the Commit Status Publisher window.
- CVE-2023-34218Critical
In JetBrains TeamCity before version 2023.05, it was possible to bypass permission checks, allowing for the execution of admin actions.
- CVE-2026-106219Medium
JetBrains TeamCity before 2026.2.1 contains a vulnerability due to missing validation of Git submodule URLs, allowing reading local repositories on the server. Attackers can exploit this to access confidential data.
Original NVD description (English source)
In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
Vulnerability data from NVD (NIST) · CISA KEV · EPSS