Loading vulnerability…
Authentication Bypass Exposure of Internal API in JetBrains TeamCity On-Premises
CVE-2026-44413 is a high-severity post-authentication vulnerability in JetBrains TeamCity On-Premises affecting versions before 2026.1 and the 2025.11 branch before 2025.11.5. The flaw is rooted in missing authentication enforcement on certain internal TeamCity server API endpoints. An authenticated user, including a low-privilege user and potentially a guest user when guest access is enabled, can perform actions that cause portions of the internal server API to become accessible to unauthenticated parties under specific deployment conditions. The issue is classified as CWE-306. TeamCity Cloud is not affected.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can expose portions of the TeamCity server API to unauthorized users, creating a privilege-escalation path from a low-privilege authenticated account to broader access to sensitive server-side functionality and data. Depending on which API areas become exposed, this can lead to disclosure of sensitive information such as tokens, source-control credentials, build secrets, logs, and user data, and may enable follow-on compromise of CI/CD workflows, source repositories, cloud resources, or other connected systems. The available information indicates high confidentiality impact, limited integrity impact, and no direct availability impact.
If you can’t patch tonight, do this now.
If immediate remediation is not possible, restrict external access to TeamCity, especially for internet-facing deployments. Limit inbound network exposure to only required ports, avoid permitting unnecessary non-standard inbound ports, and place TeamCity behind a VPN or additional access-control layer. Disable guest access where not strictly required, minimize the number of accounts with access to the server, and run TeamCity servers on dedicated hosts separate from build agents to reduce exploitable deployment conditions.
Patch, then assume compromise.
Upgrade JetBrains TeamCity On-Premises to version 2026.1 or, for the 2025.11 release line, to 2025.11.5 or later. JetBrains also released a standalone security patch plugin for TeamCity On-Premises versions 2017.1 and later for environments that cannot immediately upgrade. The plugin addresses this vulnerability specifically; upgrading remains the preferred remediation to obtain broader security fixes. On versions 2017.1 through 2018.1, applying the plugin requires a server restart, while 2018.2 and later can enable it without downtime.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.