CVE-2026-44413
HighSummary
In JetBrains TeamCity versions before 2026.1 and 2025.11.5, authenticated users could expose the server API to unauthorized access.
Risk Assessment
This could lead to unauthorized access to sensitive data and server functions, posing a serious security threat to the organization.
Recommendation
It is recommended to upgrade to the latest version of TeamCity to mitigate this vulnerability and restrict API access to authorized users only.
Other vulnerabilities in JetBrains TeamCity
See all- CVE-2026-63077CriticalActively exploited
In JetBrains TeamCity before versions 2026.1.3 and 2025.11.7, unauthenticated remote code execution is possible via the agent polling protocol.
- CVE-2026-65907Critical
In JetBrains TeamCity before 2026.1.2 and 2025.11.6, code execution in Git VCS roots was possible.
- CVE-2023-41249Medium
In JetBrains TeamCity versions before 2023.05.3, reflected XSS was possible during copying Build Step.
- CVE-2023-34225Medium
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the NuGet feed page.
- CVE-2023-34220Medium
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the Commit Status Publisher window.
- CVE-2023-34218Critical
In JetBrains TeamCity before version 2023.05, it was possible to bypass permission checks, allowing for the execution of admin actions.
- CVE-2026-65906High
In JetBrains TeamCity before versions 2026.1.2 and 2025.11.6, code execution was possible via Kotlin DSL sandbox escape.
- CVE-2026-59796High
In JetBrains TeamCity before version 2026.1.2, a vulnerability was found that allows pipeline modification due to improper permission checks.
- CVE-2026-59795High
In JetBrains TeamCity before version 2026.1.2, a stored XSS vulnerability was discovered via unauthenticated agent registration. An attacker can inject a malicious script that will be executed in other users' browsers.
- CVE-2026-59794High
In JetBrains TeamCity before version 2026.1.2, a stored XSS vulnerability was found on the cloud profile page. The attack was possible via agent-reported data.
Original NVD description (English source)
In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access