JetBrains TeamCity vulnerabilities

In JetBrains TeamCity versions before 2026.1 and 2025.11.5, authenticated users could expose the server API to unauthorized access.

In JetBrains TeamCity before 2026.1.2 and 2025.11.6, code execution in Git VCS roots was possible.

In JetBrains TeamCity versions before 2023.05.3, reflected XSS was possible during copying Build Step.

In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the NuGet feed page.

In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the Commit Status Publisher window.

In JetBrains TeamCity before version 2023.05, it was possible to bypass permission checks, allowing for the execution of admin actions.

In JetBrains TeamCity before versions 2026.1.2 and 2025.11.6, code execution was possible via Kotlin DSL sandbox escape.

In JetBrains TeamCity before version 2026.1.2, a vulnerability was found that allows pipeline modification due to improper permission checks.

In JetBrains TeamCity before version 2026.1.2, a stored XSS vulnerability was discovered via unauthenticated agent registration. An attacker can inject a malicious script that will be executed in other users' browsers.

In JetBrains TeamCity before version 2026.1.2, a stored XSS vulnerability was found on the cloud profile page. The attack was possible via agent-reported data.

In JetBrains TeamCity before version 2026.1.2, a vulnerability allowed unauthorized arbitrary file access through the Perforce VCS integration.

A stored cross-site scripting vulnerability was found in JetBrains TeamCity before 2026.1 on the SAML login page. Attackers can inject a malicious script that executes on each login.

In JetBrains TeamCity before 2026.1, the SAML plugin allows an open redirect, which can be used for phishing attacks.

In JetBrains TeamCity before 2026.1, credentials could be exposed in thread names.

In JetBrains TeamCity before 2026.1, credentials parameters were exposed via parameter autocompletion.

In JetBrains TeamCity before 2025.11.2, sensitive data is exposed via default agent parameters.

In JetBrains TeamCity before 2026.1, insufficient username validation in the SAML plugin.

JetBrains TeamCity before versions 2026.1 and 2025.11.5 is vulnerable to reflected XSS on the repository download page. An attacker can inject a malicious script that executes in the victim's browser.

In JetBrains TeamCity before version 2026.1, improper permission checks expose build configuration parameters. Users without proper permissions may access sensitive settings.

JetBrains TeamCity before version 2026.1 is vulnerable to remote code execution via Perforce connection settings. An attacker can exploit this to execute arbitrary code on the TeamCity server.

In JetBrains TeamCity before versions 2026.1 and 2025.11.5, unauthenticated server-side request forgery (SSRF) via build status is possible.

JetBrains TeamCity before version 2026.1.1 contains a reflected Cross-Site Scripting (XSS) vulnerability in the keyword filter. An attacker can inject malicious JavaScript code that executes in the victim's browser.

In JetBrains TeamCity versions before 2023.05.3, reflected XSS was possible during user registration.

In JetBrains TeamCity versions before 2023.05.3, stored XSS was possible during Cloud Profiles configuration.

In JetBrains TeamCity versions before 2023.05.2, it was possible to perform an XSS attack via GitHub integration.

In JetBrains TeamCity versions before 2023.05.2, a ReDoS attack was possible via integration with issue trackers.

In JetBrains TeamCity before version 2023.05.2, a token with limited permissions could be used to gain full account access.

In JetBrains TeamCity before 2023.05.1 build parameters of the 'password' type could be written to the agent log.

In JetBrains TeamCity versions before 2023.05.1, reflected XSS via the Referer header was possible during artifact downloads.

In JetBrains TeamCity versions before 2023.05.1, stored XSS was possible while viewing the build log.

In JetBrains TeamCity before 2023.05.1, build chain parameters of the 'password' type could be written to the agent log.

In JetBrains TeamCity before version 2023.05.1, it was possible to perform a stored XSS attack while running custom builds.

In JetBrains TeamCity before 2023.05.1 parameters of the 'password' type could be shown in the UI in certain composite build configurations.

In JetBrains TeamCity versions before 2023.05.1, stored XSS was possible when using a custom theme.

In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present on the GitLab Connection page.

In JetBrains TeamCity versions before 2023.05, authentication checks were missing – 2FA was not checked for some sensitive account actions.

In JetBrains TeamCity before version 2023.05, a specific endpoint was vulnerable to brute force attacks.

In JetBrains TeamCity versions before 2023.05, a reflected XSS vulnerability was present on the Subscriptions page.

In JetBrains TeamCity versions before 2023.05, an open redirect vulnerability during oAuth configuration was present.

In JetBrains TeamCity before version 2023.05, 'password' type parameters from build dependencies could be logged in some cases.

In JetBrains TeamCity before version 2023.05, an XSS vulnerability was possible in the Plugin Vendor URL.

In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability existed on the 'Show Connection' page.

In JetBrains TeamCity versions before 2023.05, improper permission checks allowed users without appropriate permissions to edit Build Configuration settings via REST API.