Critical · published July 27, 2026
CVSS calls it critical at 9.8. It is confirmed in active exploitation. It sits in the 99.8th percentile for exploit probability.
🚨 A simple request could let an intruder hijack your JetBrains TeamCity setup! This unauthenticated remote code execution vulnerability is no joke! 🔥 Think of it like a party where the bouncer lets anyone in without checking IDs — suddenly, uninvited guests can mingle freely, causing all sorts of chaos! An attacker could exploit this vulnerability to take complete control of your TeamCity server, allowing them to execute any code they want. This could lead to data breaches, system corruption, or even worse — a full compromise of your CI/CD pipeline. It's absolutely devastating!
Think of it like a party where the bouncer lets anyone in without checking IDs — suddenly, uninvited guests can mingle freely, causing all sorts of chaos! This vulnerability arises from insufficient validation in the agent polling protocol, which allows unauthenticated requests to execute arbitrary code remotely. Simply put, the system trusts anyone who asks nicely!
An attacker could exploit this vulnerability to take complete control of your TeamCity server, allowing them to execute any code they want. This could lead to data breaches, system corruption, or even worse — a full compromise of your CI/CD pipeline. It's absolutely devastating! Immediate action is crucial: upgrade JetBrains TeamCity to at least version 2026.1.3 or 2025.11.7 to close this gap. Additionally, review your server configurations for any other security weaknesses. Don't wait — act now! You've got this! By following these steps, you'll be on your way to securing your setup in no time! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| jetbrains/teamcity | < 2025.11.7 | 2025.11.7 |
| jetbrains/teamcity | ≥ 2026.1, < 2026.1.3 | 2026.1.3 |