JetBrains Patches TeamCity Flaw Exposing API Data and Enabling Privilege Escalation

JetBrains has patched a high-severity vulnerability in TeamCity On-Premises, tracked as CVE-2026-44413, that can allow privilege escalation and expose parts of the TeamCity server API to unauthorized users. The company said affected deployments include TeamCity On-Premises 2025.11.4 and earlier, and advised customers to upgrade to TeamCity 2026.1 or apply the available security patch plugin. According to JetBrains, the flaw could expose sensitive data including API tokens, Git credentials, build secrets, logs, and user information, with higher risk in environments that permit inbound connections on non-standard ports or run build agents on the same host as the TeamCity server.

The issue requires access to a TeamCity account, which attackers could obtain through brute force, credential stuffing, leaked credentials, social engineering, or enabled guest access, raising the prospect of follow-on compromise of cloud infrastructure, source code repositories, and software delivery pipelines. The disclosure comes against a backdrop of repeated TeamCity security incidents, including CVE-2024-27198 and CVE-2024-27199, two critical flaws that allowed unauthenticated attackers to bypass authentication, take over servers, alter certificates and ports, and create supply-chain attack paths; those earlier bugs were fixed in 2023.11.4 after researchers warned they could lead to full server compromise.