EUVD-2026-33385
GHSA-pm3g-f677-ppfg
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Primary rating from Vendor (JetBrains) · only source for this CVE.
CVSS VectorVendor: JetBrains
Lifecycle Timeline
2DescriptionCVE.org
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
AnalysisAI
Sensitive data exposure in JetBrains TeamCity before 2025.11.2 allows authenticated low-privileged users to read confidential values stored in default build agent parameters. The root cause (CWE-526) indicates that sensitive information - such as API keys, tokens, or credentials - is passed or stored through agent environment/configuration parameters without adequate access restrictions. With a CVSS score of 4.3 and no public exploit or KEV listing, this represents a moderate-priority information disclosure risk, most dangerous in environments where agent parameters are used to propagate secrets across pipelines.
Technical ContextAI
JetBrains TeamCity is a CI/CD platform that uses build agents to execute pipeline jobs. Agents can be configured with default parameters, which are key-value pairs passed into build configurations - commonly used to inject environment variables, tool paths, or credentials. CWE-526 (Cleartext Storage of Sensitive Information in an Environment Variable) identifies the root cause: sensitive values stored or exposed via these parameters are accessible to users who should not be able to read them. The affected CPE (cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:*) covers all platform variants of TeamCity prior to version 2025.11.2. The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N confirms network-accessible exploitation with low-complexity and low-privilege requirements, limited to a confidentiality impact only.
RemediationAI
Upgrade JetBrains TeamCity to version 2025.11.2 or later, as this is the vendor-confirmed patched release per the advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. As an immediate compensating control prior to patching, audit all default agent parameters and remove or replace any sensitive values (API keys, passwords, tokens) stored there - instead, use TeamCity's dedicated secure parameter type (marked as 'password' type), which masks values and restricts visibility. Additionally, apply the principle of least privilege to TeamCity user roles, restricting access to agent configuration pages to administrators only. Note that restricting user roles may break workflows where developers currently need to view agent parameters for debugging purposes.
Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute ar
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible. Rated criti
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible. Rated criti
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible. Rated critical severity (CVSS
Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sa
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration. Rated critical s
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific e
In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible. Rated c
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. Rated
In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. Rated critical sev
In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible. Rated critical severity (CVSS 9
In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases. Rated critical severity (CVS
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today