JetBrains TeamCity EUVD-2026-33382

Attacker must hold a valid authenticated TeamCity account with at least low-privilege access (PR:L in the CVSS vector), so the server must be reachable by the attacker and they must possess or obtain working credentials - for example a developer, contractor, build-agent service account, or any role created via SSO/LDAP that grants basic TeamCity login. The target TeamCity server must be running an on-premises version prior to 2026.1 with build configurations that contain parameters worth disclosing (passwords, tokens, environment values). Exploitation is limited by the requirement for prior authentication and by whether the deployment exposes the TeamCity API to the attacker's network position; purely internal, network-isolated TeamCity instances with tightly controlled accounts present a smaller realistic attack surface than internet-exposed or contractor-accessible servers.

The CVSS vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L describes a remote, low-complexity attack requiring only low privileges and no user interaction, which is realistic for a multi-tenant CI server where many developers, contractors, and service accounts hold basic project-viewer roles. Confidentiality impact is rated High because build parameters routinely include secrets that pivot to production systems, while the Low integrity and availability impacts reflect that the underlying weakness is disclosure rather than direct write or denial of service. EPSS and CISA KEV status were not provided in the input, so widespread automated exploitation cannot be confirmed; however, TeamCity has historically been a high-value target (prior CVEs have appeared in KEV), so defenders should not treat the absence of exploitation telemetry as proof of low real-world risk. The tag 'Authentication Bypass' in the source data is slightly misleading - the CVSS PR:L and the description point to broken authorization for already-authenticated users, not unauthenticated bypass; this discrepancy should be verified against the vendor advisory before scoping exposure.

A contractor or compromised developer account with only a basic project-viewer role on one team's project authenticates to the TeamCity REST API and issues a parameter-enumeration request against a build configuration belonging to a different, higher-privileged project. Because the authorization check is missing, the server returns the parameter values - including deployment credentials and cloud API tokens - which the attacker then uses to pivot into production infrastructure outside TeamCity. No public exploit identified at time of analysis, but the low attack complexity means a working request can be constructed once the vulnerable endpoint is identified.