JetBrains TeamCity CVE-2026-49381

Exploitation requires that the attacker hold high-privilege (admin-level) access to the TeamCity instance, as confirmed by the CVSS PR:H vector. The victim must subsequently visit the SAML login page (UI:R), meaning the SAML SSO feature must be configured and in use. Exploitation is not possible against default TeamCity installations where SAML is not enabled, and is not achievable by unauthenticated or low-privilege users. The limiting factors - admin-level pre-authentication and required victim interaction - significantly constrain real-world exploitability.

The CVSS score of 3.4 (Low) accurately reflects the constrained real-world impact: PR:H means the attacker must already hold high-privilege (administrator-level) access to TeamCity to inject the payload, which severely limits the exploitable population. UI:R further requires a victim to visit the SAML login page, adding another prerequisite. The scope change (S:C) with C:L indicates potential to exfiltrate limited data - such as browser context or session tokens - from affected users' browsers, but integrity and availability are unimpacted. No EPSS score was provided in the intelligence, and there is no KEV listing or known POC, suggesting no public or active exploitation at time of writing. The practical risk is low: an admin who can inject XSS on the login page likely already has more direct attack paths within TeamCity. The primary realistic threat model is insider abuse or a compromised admin account being leveraged to persist a credential-harvesting payload targeting other users.

A threat actor with administrative access to a TeamCity instance - whether via a compromised admin credential or a malicious insider - injects a stored JavaScript payload into the SAML login page configuration. Any user who subsequently visits the SAML login page has the script execute in their browser, potentially exfiltrating session tokens or browser-accessible data back to the attacker. No public proof-of-concept exploit has been identified at time of analysis.