JetBrains TeamCity CVE-2026-100254

Exploitation requires (1) the TeamCity server to be running on a Windows host - the flaw does not apply to non-Windows deployments; (2) an authenticated account with sufficient access to configure Pipeline Git connection settings (PR:L); and (3) TeamCity versions before 2026.2, 2026.1.4, or 2025.11.8. The attack works remotely over the network with low complexity and no user interaction, but the authentication requirement and Windows-only scope limit the exposed population. Upgrading to the fixed versions removes the CRLF-injection path.

This is a genuine priority for organizations running TeamCity on Windows. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 8.8 HIGH) describes a network-reachable, low-complexity flaw requiring only low-privilege authentication and no user interaction, yielding full confidentiality, integrity, and availability impact via OS command execution - consistent with CWE-78 (OS command injection through CRLF injection). No EPSS score, KEV listing, SSVC decision, or POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk case rests on the intrinsic severity (authenticated command execution on the CI server host) rather than observed weaponization. The key limiting factor NOT reflected in a network-vector reading is that exploitation is confined to Windows servers and requires an authenticated account able to reach Pipeline Git connection settings - a real but meaningful gate. A compromised CI/build server is high-value (source code, signing keys, deploy credentials, supply-chain pivot), so despite the absence of exploitation signals this warrants prompt patching. The reference is a JetBrains advisory landing page rather than a version-specific bulletin, so patch details should be confirmed against the vendor's per-issue entry.

An attacker with a valid low-privilege TeamCity account (or a compromised developer credential) edits a Pipeline's Git connection settings and injects CRLF sequences that break out into an OS command on the underlying Windows build/server host. When the connection is processed, the injected command runs in the TeamCity server context, giving the attacker code execution on the CI server. No public exploit code is identified at time of analysis.