EUVD-2026-33381
GHSA-hqxf-vmvp-qr3c
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable UI with low complexity and no user interaction, but requires an authenticated user able to edit Perforce VCS settings (PR:L); code execution on host yields high C/I/A.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
5DescriptionNVD
In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings
AnalysisAI
Remote code execution in JetBrains TeamCity before 2026.1 allows an authenticated user with project/build configuration rights to run arbitrary code on the CI server by tampering with Perforce (P4) connection settings. The flaw stems from unsafe handling of version-control connection parameters (CWE-88, argument injection), and while it carries a high CVSS of 8.8 with total technical impact, there is no public exploit identified at time of analysis and its EPSS probability is 0.00%.
Technical ContextAI
TeamCity is JetBrains' continuous-integration and build-management server, which integrates with numerous version-control systems including Perforce (Helix Core). Integration is driven by invoking the Perforce command-line client (p4) with parameters derived from user-supplied VCS connection settings. The assigned weakness class CWE-88 (Improper Neutralization of Argument Delimiters in a Command, i.e. argument injection) indicates that specially crafted values in the Perforce connection configuration are passed to the underlying p4 process without adequate sanitization, letting an attacker smuggle additional command-line arguments or options that alter execution and lead to code execution on the TeamCity host. The single affected CPE is cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*, covering all TeamCity releases prior to 2026.1.
RemediationAI
Upgrade JetBrains TeamCity to version 2026.1 or later, which is the first release that resolves the issue (a vendor patch is available per the JetBrains fixed-issues page at https://www.jetbrains.com/privacy-security/issues-fixed/); this is the primary and recommended fix. If immediate upgrade is not possible, reduce exposure by tightly restricting which users hold project-administration and VCS-root editing permissions so that only fully trusted operators can create or modify Perforce connection settings (trade-off: may slow delegated project onboarding), and audit existing Perforce VCS roots for unexpected or malformed connection parameters. Where Perforce integration is not actually used, avoid configuring Perforce VCS roots at all. Consult the vendor advisory (https://www.jetbrains.com/privacy-security/issues-fixed/) and https://nvd.nist.gov/vuln/detail/CVE-2026-49373 before and after patching to confirm the fixed build.
Path traversal in JetBrains TeamCity before 2023.11.4 enables remote attackers to perform a limited set of administrativ
Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute ar
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible. Rated criti
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible. Rated criti
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible. Rated critical severity (CVSS
Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sa
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration. Rated critical s
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific e
In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible. Rated c
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. Rated
In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. Rated critical sev
In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible. Rated critical severity (CVSS 9
Share
External POC / Exploit Code
Leaving vuln.today