JetBrains TeamCity EUVD-2026-33387

Exploitation requires a valid low-privileged TeamCity account, confirmed by the CVSS vector PR:L. The attacker must additionally be able to view JVM thread names through at least one of the following surfaces: TeamCity's internal diagnostics or administration pages, an exposed JMX port, an attached APM agent that captures thread metadata, or a log aggregation system that records thread context. Unauthenticated attackers cannot exploit this vulnerability directly. Default-hardened deployments that restrict diagnostic and JMX access exclusively to server administrators substantially reduce exposure, since a standard developer account alone is insufficient if no thread-name-visible surface is reachable. The attack is limited to confidentiality impact - no modification of data or service disruption is possible through this vulnerability.

The CVSS 3.1 base score of 6.5 (Medium) reflects network accessibility (AV:N), low attack complexity (AC:L), low privilege requirement (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high confidentiality impact (C:H) with no integrity or availability impact. The PR:L designation confirms that exploitation requires a pre-existing authenticated session - unauthenticated remote attackers cannot directly exploit this flaw, which meaningfully constrains the attack surface compared to PR:N vulnerabilities. No EPSS score was included in the available intelligence, preventing probabilistic exploitation likelihood assessment. The vulnerability is not listed in the CISA KEV catalog and no public proof-of-concept exploit has been identified, indicating no confirmed widespread exploitation at time of analysis. Despite the medium composite score, the C:H rating carries outsized real-world risk in CI/CD contexts: credentials stored in TeamCity frequently include cloud provider keys, container registry tokens, and source control secrets whose compromise enables lateral movement far beyond the TeamCity instance itself. Organizations with insider threat concerns or shared TeamCity environments with mixed trust levels should treat this as a higher operational priority than the raw CVSS score suggests.

An attacker holding a low-privileged TeamCity account - or an insider with standard developer access - authenticates to the TeamCity server and navigates to a diagnostic interface or triggers a JVM thread dump through an exposed JMX or monitoring endpoint. Inspecting the resulting thread list reveals plaintext credential values embedded in thread names by the affected code paths. The attacker extracts those credentials and uses them to authenticate to connected systems such as GitHub, AWS, or a container registry, gaining access well beyond their intended TeamCity permissions.