EUVD-2026-29176
GHSA-f2hf-494q-j864
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach TeamCity server over network
-
ExploitAccess improperly protected server API
-
ImpactRetrieve sensitive data without authorization
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A07:2025 - Authentication Failures
ASVS 5.0
V6 - Authentication Authentication required for critical functions
MITRE ATT&CK
1 technique across 1 tactic: Initial Access The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The flaw exposes the TeamCity server API to unauthorised access; per CWE-306 an authentication/authorisation control is missing or incomplete on API endpoints. The sources conflict on the precondition: the description states that 'authenticated users' trigger the exposure (implying a valid, possibly low-privilege account is needed), whereas the CVSS vector encodes PR:N (no authentication). The specific endpoint, feature, or configuration that produces the exposure is not described in the available sources. Limiting factors: impact is confidentiality-only (no integrity or availability effect), and network reachability of the TeamCity server is required; affected deployments are versions before 2026.1 and 2025.11.5. Authentication requirements are not confirmed from available data due to the PR:N-vs-'authenticated users' conflict. |
| Impact | Signals point to a real but non-urgent issue. CVSS 7.5 is driven entirely by confidentiality (C:H, I:N, A:N) with a network vector and low complexity. However, the signals conflict on the key question of authentication: the official CVSS vector states PR:N (unauthenticated), while the description explicitly says 'authenticated users could expose server API' and the CWE is CWE-306 (Missing Authentication for a Critical Function) - these cannot both be literally true, so the precondition should be verified with JetBrains. The exploitation signals are uniformly cold: EPSS is 0.00% (0th percentile), there is no CISA KEV listing, SSVC reports Exploitation: none, Automatable: no, and only partial technical impact, and no public exploit was found. The vuln.today decision label is 'this_week', consistent with a patched, moderate-confidentiality flaw that should be remediated on a normal cycle rather than treated as an emergency. Net: a genuine information-exposure flaw in widely used CI/CD infrastructure worth prompt patching, but not evidence of an at-scale or actively exploited threat. |
| Exploit ScenarioDerived | An attacker with reach to the TeamCity server leverages the missing/weak authentication control to reach server API endpoints that should be protected, retrieving sensitive information (CWE-306, C:H). The exact trigger - whether a valid low-privilege account is first required or whether exposure occurs with no authentication - is not clearly described in the available sources, and no public proof-of-concept or exploit code was identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv3 – Oct 26, 2026
JetBrains TeamCity before 2026.1 and 2025.11.5 can expose its server API to unauthorised access, allowing remote attackers to read data the API was meant to protect, with confidentiality-only impact and no effect on integrity or availability. Authentication requirements are not confirmed from available data: the description refers to 'authenticated users' while the published CVSS vector encodes PR:N, so the assessed vector uses PR:L and the precondition remains unresolved. No public exploit was identified at time of analysis; EPSS is 0.00%, CISA SSVC records no exploitation and no automatable path, and the vendor has released fixes.
Earlier versions of this analysis (2)
JetBrains TeamCity servers before 2026.1 and 2025.11.5 can expose their server API to unauthorised access, leading to confidentiality loss (C:H) with no integrity or availability impact. The vendor advisory and NVD vector disagree on prerequisites: the NVD vector scores it PR:N while the description states authenticated users are involved in exposing the API, so whether valid TeamCity credentials are required is not confirmed from the available data. No public exploit code is identified at time of analysis, EPSS is 0.00% (percentile 0), SSVC records Exploitation: none and Automatable: no, and signals point to a real but non-urgent issue rather than an emergency; a vendor patch is available.
Authentication bypass in JetBrains TeamCity allows remote unauthenticated attackers to gain unauthorized access to server APIs. Despite the CVE description stating 'authenticated users could expose server API,' the CVSS vector (PR:N) confirms no authentication is required for exploitation, enabling direct unauthorized API access with high confidentiality impact and limited integrity impact. JetBrains has released patches in versions 2026.1 and 2025.11.5. EPSS and KEV status not available at time of analysis.
RemediationAI
Upgrade to a fixed release: TeamCity 2026.1 or 2025.11.5, as listed in the vendor's fixed-issues page (https://www.jetbrains.com/privacy-security/issues-fixed/); patch availability is confirmed by the vendor. The available sources do not describe a documented workaround for builds that cannot be upgraded immediately, and the exposure requires network reachability of the TeamCity server, so limiting which networks can reach the server's API is the only exposure-reduction measure the evidence supports while an upgrade is scheduled. No public exploit was identified, EPSS is 0.00% and SSVC records no exploitation, which supports handling this within a normal weekly patch cycle rather than as an emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-306 (Missing Authentication for Critical Function), meaning an authentication or authorisation control is absent or incomplete on TeamCity server API functionality, so API surface intended to be restricted can be reached without the expected check. JetBrains TeamCity is a CI/CD server whose API exposes build, project and configuration data, which is consistent with the confidentiality-only impact recorded in the vector (C:H/I:N/A:N) and with the tag 'Authentication Bypass'. CPE cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:* and EUVD data place affected builds below 2026.1 and below 2025.11.5. The specific endpoint, feature or configuration that produces the exposure, and the exact trigger, are not described in the available sources, and the sources conflict on whether a valid low-privilege account is required (description: 'authenticated users') or not (published vector: PR:N); network reachability of the TeamCity server is required either way.
Know when Teamcity gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description attributes the action to 'authenticated users' so PR:L is chosen over the input's PR:N; network API with low complexity, confidentiality-only exposure.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access
Executive ViewAI
JetBrains TeamCity versions before 2026.1 and 2025.11.5 have an API access control flaw that could allow unauthorized reading of data intended to be protected, affecting confidentiality of information exposed through the server API. Leadership should care because this could lead to unauthorized disclosure of sensitive build, configuration, or project data, potentially impacting intellectual property or credentials managed within TeamCity, though no active exploitation is currently observed.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Path traversal in JetBrains TeamCity before 2023.11.4 enables remote attackers to perform a limited set of administrativ
Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute ar
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible. Rated criti
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible. Rated criti
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible. Rated critical severity (CVSS
Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sa
Sandbox escape in JetBrains TeamCity's Kotlin DSL configuration mechanism allows an attacker who can supply or modify ve
JetBrains TeamCity versions prior to 2026.2, 2026.1.4, and 2025.11.8 contain a flaw in the password reset mechanism that
Remote code execution affects JetBrains TeamCity releases older than 2026.2, 2026.1.4, and 2025.11.8, where a type-white
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration. Rated critical s
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific e
In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible. Rated c
Exploit-DB