EUVD-2026-29176
GHSA-f2hf-494q-j864
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access
AnalysisAI
Authentication bypass in JetBrains TeamCity allows remote unauthenticated attackers to gain unauthorized access to server APIs. Despite the CVE description stating 'authenticated users could expose server API,' the CVSS vector (PR:N) confirms no authentication is required for exploitation, enabling direct unauthorized API access with high confidentiality impact and limited integrity impact. JetBrains has released patches in versions 2026.1 and 2025.11.5. EPSS and KEV status not available at time of analysis.
Technical ContextAI
TeamCity is a continuous integration and deployment server platform by JetBrains. This vulnerability is classified as CWE-306 (Missing Authentication for Critical Function), indicating that server API endpoints lack proper authentication controls. The CVSS vector confirms network-accessible exploitation with low complexity against default configurations. The discrepancy between the description mentioning 'authenticated users' and the CVSS PR:N metric suggests the vulnerability may involve authenticated users inadvertently creating conditions that bypass authentication for subsequent requests, or API endpoints that should require authentication but accept unauthenticated requests.
RemediationAI
Upgrade JetBrains TeamCity to version 2026.1 or 2025.11.5 or later, depending on your maintenance branch, as documented in the vendor advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. For organizations unable to immediately patch, implement network-level access controls to restrict TeamCity server access to trusted IP ranges only, blocking public internet exposure. Configure web application firewall (WAF) rules to enforce authentication on all API endpoints if feasible, though this may interfere with legitimate integrations and requires thorough testing. Audit existing API access logs for unauthorized access patterns prior to patching. Review and rotate any credentials or tokens accessible through TeamCity APIs. These mitigations reduce attack surface but do not eliminate the vulnerability-prioritize patching over compensating controls.
Path traversal in JetBrains TeamCity before 2023.11.4 enables remote attackers to perform a limited set of administrativ
Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute ar
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible. Rated criti
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible. Rated criti
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible. Rated critical severity (CVSS
Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sa
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration. Rated critical s
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific e
In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible. Rated c
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. Rated
In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. Rated critical sev
In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible. Rated critical severity (CVSS 9
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today