Authentication bypass exposure of internal server API in JetBrains TeamCity On-Premises

Successful exploitation can expose portions of the TeamCity server API to unauthorized access, creating a privilege-escalation and sensitive-information exposure scenario. Depending on which API functionality becomes reachable, attackers may gain access to data commonly handled by TeamCity, including build-related secrets, credentials, tokens, logs, and user information. Because TeamCity commonly sits at the center of CI/CD workflows, such exposure can facilitate follow-on compromise of source code repositories, cloud infrastructure, deployment systems, and software delivery pipelines. The available information indicates high confidentiality impact, limited integrity impact, and no direct availability impact.

If immediate remediation is not possible, reduce exposure by restricting external access to TeamCity, especially for internet-facing deployments. Limit inbound network access to only required ports, avoid permitting unnecessary non-standard inbound ports, and place TeamCity behind a VPN or additional access-control layer. Disable guest access where not strictly required, and run TeamCity servers on dedicated hosts separate from build agents. These measures reduce the conditions under which an authenticated user could expose internal API functionality to unauthorized parties.

Upgrade JetBrains TeamCity On-Premises to version 2026.1 or, for the 2025.11 release line, to 2025.11.5 or later. JetBrains also released a standalone security patch plugin for TeamCity On-Premises versions 2017.1 and later for environments that cannot immediately upgrade. The plugin addresses this vulnerability specifically; upgrading to a current supported release remains the preferred remediation to obtain broader security fixes. For older supported branches, note that versions 2017.1 through 2018.1 require a full server restart after installing the plugin, while 2018.2 and later can enable it without downtime.