JetBrains TeamCity vulnerabilities

In JetBrains TeamCity versions before 2026.1 and 2025.11.5, authenticated users could expose the server API to unauthorized access.

In JetBrains TeamCity before 2026.1.2 and 2025.11.6, code execution in Git VCS roots was possible.

In JetBrains TeamCity versions before 2023.05.3, reflected XSS was possible during copying Build Step.

In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the NuGet feed page.

In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the Commit Status Publisher window.

In JetBrains TeamCity before version 2023.05, it was possible to bypass permission checks, allowing for the execution of admin actions.

JetBrains TeamCity before 2026.2.1 contains a vulnerability due to missing validation of Git submodule URLs, allowing reading local repositories on the server. Attackers can exploit this to access confidential data.

In JetBrains TeamCity before versions 2026.1.3 and 2025.11.7, a Kotlin DSL sandbox escape leading to remote code execution (RCE) on the server was possible. The vulnerability allows an attacker to execute arbitrary code in the context of the TeamCity server.

In JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8, administrator account takeover was possible via password reset.

In JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8, authenticated users can execute commands on Windows servers via CRLF injection in Pipeline Git connection settings.

In JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8, a sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL.

In JetBrains TeamCity before versions 2026.1.2 and 2025.11.6, code execution was possible via Kotlin DSL sandbox escape.

In JetBrains TeamCity before version 2026.1.2, a vulnerability was found that allows pipeline modification due to improper permission checks.

In JetBrains TeamCity before version 2026.1.2, a stored XSS vulnerability was discovered via unauthenticated agent registration. An attacker can inject a malicious script that will be executed in other users' browsers.

In JetBrains TeamCity before version 2026.1.2, a stored XSS vulnerability was found on the cloud profile page. The attack was possible via agent-reported data.

In JetBrains TeamCity before version 2026.1.2, a vulnerability allowed unauthorized arbitrary file access through the Perforce VCS integration.

A stored cross-site scripting vulnerability was found in JetBrains TeamCity before 2026.1 on the SAML login page. Attackers can inject a malicious script that executes on each login.

In JetBrains TeamCity before 2026.1, the SAML plugin allows an open redirect, which can be used for phishing attacks.

In JetBrains TeamCity before 2026.1, credentials could be exposed in thread names.

In JetBrains TeamCity before 2026.1, credentials parameters were exposed via parameter autocompletion.

In JetBrains TeamCity before 2025.11.2, sensitive data is exposed via default agent parameters.

In JetBrains TeamCity before 2026.1, insufficient username validation in the SAML plugin.

JetBrains TeamCity before versions 2026.1 and 2025.11.5 is vulnerable to reflected XSS on the repository download page. An attacker can inject a malicious script that executes in the victim's browser.

In JetBrains TeamCity before version 2026.1, improper permission checks expose build configuration parameters. Users without proper permissions may access sensitive settings.

JetBrains TeamCity before version 2026.1 is vulnerable to remote code execution via Perforce connection settings. An attacker can exploit this to execute arbitrary code on the TeamCity server.

In JetBrains TeamCity before versions 2026.1 and 2025.11.5, unauthenticated server-side request forgery (SSRF) via build status is possible.

JetBrains TeamCity before version 2026.1.1 contains a reflected Cross-Site Scripting (XSS) vulnerability in the keyword filter. An attacker can inject malicious JavaScript code that executes in the victim's browser.

In JetBrains TeamCity before 2025.11, path traversal was possible via file upload.

In JetBrains TeamCity before 2025.11, stored XSS was possible via a session attribute.

In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata.

In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure.

In JetBrains TeamCity versions before 2023.05.3, reflected XSS was possible during user registration.

In JetBrains TeamCity versions before 2023.05.3, stored XSS was possible during Cloud Profiles configuration.

In JetBrains TeamCity versions before 2023.05.2, it was possible to perform an XSS attack via GitHub integration.

In JetBrains TeamCity versions before 2023.05.2, a ReDoS attack was possible via integration with issue trackers.

In JetBrains TeamCity before version 2023.05.2, a token with limited permissions could be used to gain full account access.

In JetBrains TeamCity before 2023.05.1 build parameters of the 'password' type could be written to the agent log.

In JetBrains TeamCity versions before 2023.05.1, reflected XSS via the Referer header was possible during artifact downloads.

In JetBrains TeamCity versions before 2023.05.1, stored XSS was possible while viewing the build log.

In JetBrains TeamCity before 2023.05.1, build chain parameters of the 'password' type could be written to the agent log.

In JetBrains TeamCity before version 2023.05.1, it was possible to perform a stored XSS attack while running custom builds.

In JetBrains TeamCity before 2023.05.1 parameters of the 'password' type could be shown in the UI in certain composite build configurations.

In JetBrains TeamCity versions before 2023.05.1, stored XSS was possible when using a custom theme.

In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present on the GitLab Connection page.

In JetBrains TeamCity versions before 2023.05, authentication checks were missing – 2FA was not checked for some sensitive account actions.

In JetBrains TeamCity before version 2023.05, a specific endpoint was vulnerable to brute force attacks.

In JetBrains TeamCity versions before 2023.05, a reflected XSS vulnerability was present on the Subscriptions page.