EUVD-2026-33387
GHSA-pwcg-7wj6-m8gv
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Primary rating from Vendor (JetBrains) · only source for this CVE.
CVSS VectorVendor: JetBrains
Lifecycle Timeline
2DescriptionCVE.org
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
AnalysisAI
Credential exposure in JetBrains TeamCity before version 2026.1 allows authenticated remote attackers to retrieve sensitive secrets via JVM thread name inspection. The root cause (CWE-522 - Insufficiently Protected Credentials) is TeamCity embedding credential values directly into thread names, which surfaces in thread dumps, monitoring interfaces, and diagnostic tooling accessible to low-privileged users. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, but the high confidentiality impact (CVSS C:H) makes it a significant credential theft vector in enterprise CI/CD environments where TeamCity routinely holds access tokens to source repositories, cloud infrastructure, and deployment targets.
Technical ContextAI
JetBrains TeamCity is a widely deployed enterprise CI/CD automation server built on the JVM. CWE-522 (Insufficiently Protected Credentials) describes the root cause class: credentials are stored or transmitted without adequate protection against unintended disclosure. In this instance, TeamCity embeds credential values - likely API tokens, passwords, or build-step secrets - into Java thread names. Thread names are not treated as sensitive by the JVM and are routinely exposed through thread dump utilities (jstack, VisualVM, JConsole), JMX monitoring endpoints, application performance monitoring agents, and server-side log collectors that capture thread context. The CPE string cpe:2.3:a:jetbrains:teamcity:*:*:*:*:*:*:*:* covers all TeamCity application versions prior to the 2026.1 release, indicating the flaw is not limited to a specific branch or edition.
RemediationAI
Upgrade JetBrains TeamCity to version 2026.1 or later, which resolves this vulnerability per the vendor advisory at https://www.jetbrains.com/privacy-security/issues-fixed/. For environments unable to upgrade immediately, restrict access to JVM diagnostic surfaces - including JMX endpoints, built-in thread dump pages, and any APM or log aggregation pipelines that capture thread metadata - to trusted administrators only, reducing the pool of accounts that can observe thread names. As a secondary compensating control, audit and rotate any credentials stored in TeamCity build configurations or parameters that may have been captured in historical thread dumps, log archives, or monitoring snapshots. To reduce blast radius should a credential already be compromised, apply least-privilege scoping to all secrets stored in TeamCity so that individual tokens grant minimal access to downstream systems. Note that restricting diagnostic access does not eliminate the underlying defect and should be treated as a temporary measure pending the patch.
Path traversal in JetBrains TeamCity before 2023.11.4 enables remote attackers to perform a limited set of administrativ
Remote code execution in JetBrains TeamCity before 2026.1.3 and 2025.11.7 allows unauthenticated attackers to execute ar
In JetBrains TeamCity before 2023.11.4 authentication bypass allowing to perform admin actions was possible. Rated criti
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible. Rated criti
In JetBrains TeamCity before 2023.11.3 authentication bypass leading to RCE was possible. Rated critical severity (CVSS
Remote code execution in JetBrains TeamCity before 2026.1.2 and 2025.11.6 allows an attacker to escape the Kotlin DSL sa
In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration. Rated critical s
In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 authentication bypass was possible in specific e
In JetBrains TeamCity before 2023.05 bypass of permission checks allowing to perform admin actions was possible. Rated c
JetBrains TeamCity before 2021.2.3 was vulnerable to OS command injection in the Agent Push feature configuration. Rated
In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible. Rated critical sev
In JetBrains TeamCity before 2021.1.4, GitLab authentication impersonation was possible. Rated critical severity (CVSS 9
Same weakness CWE-522 – Insufficiently Protected Credentials
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today