What is the CVSS score of CVE-2026-49374?

CVE-2026-49374 has a CVSS 3.1 base score of 7.6 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L. EPSS exploitation probability: 0.0%.

Which versions of JetBrains TeamCity are affected by CVE-2026-49374?

JetBrains TeamCity contains an information disclosure vulnerability allowing any authenticated user to access sensitive build configuration parameters containing deployment credentials, API tokens,…. A patch is available.

How to fix or mitigate CVE-2026-49374?

Within 24 hours: Audit all credentials currently stored in TeamCity build configuration parameters and review access logs for signs of unauthorized disclosure. Within 7 days: Rotate all credentials stored in TeamCity; implement role-based access controls limiting build parameter visibility to essential personnel; transition sensitive credentials to external secret management solutions. Within 30 days: Establish monitoring for JetBrains security releases; plan upgrade to TeamCity version 2026.1 or later once available.

JetBrains TeamCity CVE-2026-49374

EUVD-2026-33382 HIGH

Missing Authorization (CWE-862)

2026-05-29 JetBrains

GHSA-pqrm-v5f6-j44f

Authentication Bypass Teamcity JetBrains

7.6

CVSS 3.1 · Vendor: JetBrains

Severity by source

Vendor (JetBrains) PRIMARY

7.6 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L

Primary rating from Vendor (JetBrains) · only source for this CVE.

CVSS VectorVendor: JetBrains

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

Low

Availability

Low

Lifecycle Timeline

Patch available

May 29, 2026 - 20:02 EUVD

Analysis Generated

May 29, 2026 - 18:51 vuln.today

CVE Published

May 29, 2026 - 18:15 nvd

HIGH 7.6

DescriptionCVE.org

In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters

AnalysisAI

Information disclosure in JetBrains TeamCity prior to version 2026.1 allows authenticated low-privilege users to read sensitive build configuration parameters they should not have access to due to missing authorization checks. The flaw carries a CVSS 7.6 score driven by high confidentiality impact on a network-reachable CI/CD server, though no public exploit identified at time of analysis. Because TeamCity build parameters frequently contain secrets such as deployment credentials, signing keys, and API tokens, the disclosure can cascade into broader compromise of downstream systems.

Technical ContextAI

JetBrains TeamCity is a widely deployed continuous integration and build management server where build configurations carry parameters (typed values, passwords, environment variables, system properties) intended to be scoped by project-level role assignments. The root cause is CWE-862 Missing Authorization, meaning the server accepts a request to view or enumerate configuration parameters without verifying that the requesting account holds the permission required for the target project or build configuration. In TeamCity's permission model, parameters can be marked as 'password' type which masks them in the UI, but the underlying API surface must still enforce role-based access; when an authorization check is omitted at that layer, even masked secrets and project-private parameters can be returned to lower-privileged callers. The CPE confirms the affected product is the TeamCity application itself rather than a plugin or agent, and the issue affects all versions prior to 2026.1.

RemediationAI

Vendor-released patch: TeamCity 2026.1 - upgrade on-premises servers to 2026.1 or later as the primary fix, following the JetBrains upgrade guidance referenced from https://www.jetbrains.com/privacy-security/issues-fixed/. Where immediate upgrade is not feasible, reduce blast radius by auditing and tightening project-level role assignments so that only trusted users hold any project role, rotating any secrets that were stored as TeamCity parameters (deployment keys, registry credentials, signing tokens, cloud API keys) since they must be assumed disclosed, and moving high-value secrets out of build parameters into an external secrets manager fetched at build time with short-lived tokens. As a network-layer compensating control, restrict TeamCity web UI and REST API access to a VPN or SSO-gated reverse proxy to shrink the pool of accounts that can authenticate at all; the trade-off is added friction for remote contributors and CI integrations that call the REST API directly.