JetBrains TeamCity CVE-2026-49378

Exploitation requires a valid TeamCity account with at least low-level privileges (PR:L per CVSS vector) - anonymous or unauthenticated access is insufficient. The attacker must have access to a build configuration that references credential-type parameters, and the parameter autocompletion feature must be reachable by their account (which is standard TeamCity behavior, not a special configuration). Exploitation is limited by the requirement for authenticated access, meaning external unauthenticated attackers cannot directly exploit this without first compromising a TeamCity account. The confidentiality impact is partial (C:L) - exposed data is limited to credential parameter values accessible via autocompletion context, not a full secrets dump.

The CVSS base score of 4.3 (Medium) reflects a constrained but realistic risk profile: the attack is network-accessible with low complexity (AV:N/AC:L), but requires at least low-level authenticated access (PR:L), meaning anonymous external attackers cannot directly exploit this. The scope is unchanged (S:U) and impact is limited to partial confidentiality loss (C:L) with no integrity or availability impact. No EPSS score was provided in the available data, so exploitation probability cannot be quantified from that signal. The vulnerability is not listed in CISA KEV and no public proof-of-concept code has been identified at time of analysis. Despite the moderate CVSS rating, the real-world risk is elevated in organizations with many TeamCity users, contractor accounts, or guest-accessible projects, where a low-privilege insider could silently harvest credentials used in high-privilege pipeline steps. The 'Authentication Bypass' tag in the source data warrants scrutiny - the CVSS vector indicates low-privilege authentication is required (PR:L), which does not constitute a full authentication bypass; this tag may refer to bypassing authorization checks within an authenticated session rather than bypassing login entirely.

An authenticated low-privilege TeamCity user - such as a contractor with project viewer access - navigates to a build configuration and invokes the parameter autocompletion feature while editing a script or build step. The missing authorization check causes the server to return the values of credential-type parameters they are not authorized to read, exposing secrets such as deployment tokens or service account passwords. No public exploit code exists, but the technique requires only standard TeamCity UI interaction and is trivially reproducible by any authenticated user.