EUVD-2026-33380
GHSA-62q7-rxv8-hw8r
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (JetBrains) · only source for this CVE.
CVSS VectorVendor: JetBrains
Lifecycle Timeline
3DescriptionCVE.org
In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible
AnalysisAI
Server-side request forgery in JetBrains TeamCity versions prior to 2026.1 and 2025.11.5 allows remote unauthenticated attackers to coerce the build server into issuing arbitrary outbound HTTP requests through the build status functionality. The CVSS 7.5 score (C:H/I:N/A:N) reflects high-impact disclosure of internal data without integrity or availability effects, and no public exploit is identified at time of analysis.
Technical ContextAI
JetBrains TeamCity is a widely deployed CI/CD platform used to orchestrate build pipelines, often holding privileged credentials and network connectivity to internal source control, artifact repositories, and cloud metadata services. The flaw falls under CWE-918 (Server-Side Request Forgery), in which the application accepts an attacker-influenced URL or destination and dispatches a request to it without sufficient validation. The affected component, identified in the advisory as the 'build status' surface, is reachable without authentication, meaning the TeamCity server acts as a request proxy that can be steered by an external party to interact with hosts reachable from the build server's network position.
RemediationAI
Vendor-released patch: upgrade TeamCity Server to 2026.1 or to 2025.11.5 on the LTS-style 2025.11 maintenance branch, per the JetBrains issues-fixed page at https://www.jetbrains.com/privacy-security/issues-fixed/. Until patching is complete, restrict network exposure of the TeamCity web interface to trusted networks via firewall, WAF, or reverse proxy ACLs so the unauthenticated build status endpoint is not reachable from the public internet; this will block remote SSRF probes but will also disrupt external integrations such as status badges in public README files and webhook consumers, so plan for those side effects. Additionally, egress-filter the TeamCity server's outbound traffic to deny it from reaching cloud metadata endpoints (169.254.169.254, fd00:ec2::254) and internal management ranges it has no legitimate need to contact - this contains SSRF blast radius but may break legitimate plugin or VCS connectivity if those paths are overly broad.
Path traversal in JetBrains TeamCity before 2023.11.4 enables remote attackers to perform a limited set of administrativ
Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute ar
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible. Rated criti
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible. Rated criti
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible. Rated critical severity (CVSS
Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sa
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration. Rated critical s
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific e
In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible. Rated c
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. Rated
In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. Rated critical sev
In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible. Rated critical severity (CVSS 9
Same weakness CWE-918 – Server-Side Request Forgery (SSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today