Teamcity (Jetbrains) - vulnerabilities (CVEs)

283 CVEs, 8 in the last 30 days, 162 known versions, newest CVE from 2026-10-15. Vendor: Jetbrains.

CVEs of Teamcity

• CVE-2026-111096 - CVSS 6.7 (medium), 2026-10-15: In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible
• CVE-2026-111095 - CVSS 8 (high), 2026-10-15: In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible
• CVE-2026-111094 - CVSS 9.8 (critical), 2026-10-15: In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible
• CVE-2026-106219 - CVSS 7.5 (high), 2026-10-06: In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
• CVE-2026-106218 - CVSS 10 (critical), 2026-10-06: In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
• CVE-2026-100255 - CVSS 9.8 (critical), 2026-09-30: In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset
• CVE-2026-100254 - CVSS 8.8 (high), 2026-09-30: In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git…
• CVE-2026-100253 - CVSS 8.8 (high), 2026-09-30: In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL
• CVE-2026-63077 - CVSS 9.8 (critical), 2026-07-27: In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol
• CVE-2026-65907 - CVSS 9.1 (critical), 2026-07-23: In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
• CVE-2026-65906 - CVSS 10 (critical), 2026-07-23: In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible
• CVE-2026-59796 - CVSS 8.1 (high), 2026-07-10: In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks
• CVE-2026-59795 - CVSS 8.1 (high), 2026-07-10: In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible
• CVE-2026-59794 - CVSS 7.3 (high), 2026-07-10: In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data
• CVE-2026-59793 - CVSS 8.8 (high), 2026-07-10: In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration
• CVE-2026-49381 - CVSS 4.8 (medium), 2026-05-29: In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible
• CVE-2026-49372 - CVSS 7.5 (high), 2026-05-29: In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible
• CVE-2026-49375 - CVSS 6.1 (medium), 2026-05-29: In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page
• CVE-2026-49378 - CVSS 4.3 (medium), 2026-05-29: In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion
• CVE-2026-49374 - CVSS 7.6 (high), 2026-05-29: In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters
• CVE-2026-49377 - CVSS 4.3 (medium), 2026-05-29: In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
• CVE-2026-49380 - CVSS 6.1 (medium), 2026-05-29: In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible
• CVE-2026-49373 - CVSS 8.8 (high), 2026-05-29: In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings
• CVE-2026-49376 - CVSS 6.5 (medium), 2026-05-29: In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
• CVE-2026-49379 - CVSS 6.5 (medium), 2026-05-29: In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
• CVE-2026-49371 - CVSS 8.2 (high), 2026-05-29: In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible
• CVE-2026-44413 - CVSS 8.2 (high), 2026-05-11: In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access
• CVE-2026-28196 - CVSS 2.3 (low), 2026-02-25: In JetBrains TeamCity before 2025.11.3 disabling versioned settings left a credentials config on disk
• CVE-2026-28195 - CVSS 4.3 (medium), 2026-02-25: In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations
• CVE-2026-28194 - CVSS 6.1 (medium), 2026-02-25: In JetBrains TeamCity before 2025.11.3 open redirect was possible in the React project creation flow
• CVE-2025-68164 - CVSS 2.7 (low), 2025-12-16: In JetBrains TeamCity before 2025.11 port enumeration was possible via the Perforce connection test
• CVE-2025-68267 - CVSS 6.5 (medium), 2025-12-16: In JetBrains TeamCity before 2025.11.1 excessive privileges were possible due to storing GitHub personal access token instead of an installation token
• CVE-2025-68166 - CVSS 6.1 (medium), 2025-12-16: In JetBrains TeamCity before 2025.11 a DOM-based XSS was possible on the OAuth connections tab
• CVE-2025-68165 - CVSS 6.1 (medium), 2025-12-16: In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup
• CVE-2025-68268 - CVSS 6.1 (medium), 2025-12-16: In JetBrains TeamCity before 2025.11.1 reflected XSS was possible on the storage settings page
• CVE-2025-68163 - CVSS 4.8 (medium), 2025-12-16: In JetBrains TeamCity before 2025.11 stored XSS was possible on agentpushInstall page
• CVE-2025-68162 - CVSS 2.7 (low), 2025-12-16: In JetBrains TeamCity before 2025.11 maven embedder allowed loading extensions via project configuration
• CVE-2025-67739 - CVSS 3.1 (low), 2025-12-11: In JetBrains TeamCity before 2025.11.2 improper repository URL validation could lead to local paths disclosure
• CVE-2025-67742 - CVSS 7.5 (high), 2025-12-11: In JetBrains TeamCity before 2025.11 path traversal was possible via file upload
• CVE-2025-67741 - CVSS 5.4 (medium), 2025-12-11: In JetBrains TeamCity before 2025.11 stored XSS was possible via session attribute
• CVE-2025-67740 - CVSS 5.3 (medium), 2025-12-11: In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata
• CVE-2025-59457 - CVSS 7.7 (high), 2025-09-17: In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows
• CVE-2025-59455 - CVSS 4.2 (medium), 2025-09-17: In JetBrains TeamCity before 2025.07.2 project isolation bypass was possible due to race condition
• CVE-2025-59456 - CVSS 5.5 (medium), 2025-09-17: In JetBrains TeamCity before 2025.07.2 path traversal was possible during project archive upload
• CVE-2025-57734 - CVSS 6.5 (medium), 2025-08-20: In JetBrains TeamCity before 2025.07.1 aWS credentials were exposed in Docker script files
• CVE-2025-57733 - CVSS 5.5 (medium), 2025-08-20: In JetBrains TeamCity before 2025.07.1 sMTP injection was possible allowing modification of email content
• CVE-2025-57732 - CVSS 7.5 (high), 2025-08-20: In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership
• CVE-2025-54538 - CVSS 5.5 (medium), 2025-07-28: In JetBrains TeamCity before 2025.07 password exposure was possible via command line in the "hg pull" command
• CVE-2025-54535 - CVSS 7.5 (high), 2025-07-28: In JetBrains TeamCity before 2025.07 password reset and email verification tokens were using weak hashing algorithms
• CVE-2025-54534 - CVSS 4.8 (medium), 2025-07-28: In JetBrains TeamCity before 2025.07 reflected XSS was possible on the agentpushPreset page
• CVE-2025-54537 - CVSS 5.5 (medium), 2025-07-28: In JetBrains TeamCity before 2025.07 user credentials were stored in plain text in memory snapshots
• CVE-2025-54533 - CVSS 4.3 (medium), 2025-07-28: In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via VCS configuration
• CVE-2025-54536 - CVSS 8.8 (high), 2025-07-28: In JetBrains TeamCity before 2025.07 a CSRF was possible on GraphQL endpoint
• CVE-2025-54529 - CVSS 7.5 (high), 2025-07-28: In JetBrains TeamCity before 2025.07 a CSRF was possible in external OAuth login integration
• CVE-2025-54532 - CVSS 4.3 (medium), 2025-07-28: In JetBrains TeamCity before 2025.07 improper access control allowed disclosure of build settings via snapshot dependencies
• CVE-2025-54531 - CVSS 9.4 (critical), 2025-07-28: In JetBrains TeamCity before 2025.07 path traversal was possible via plugin unpacking on Windows
• CVE-2025-54530 - CVSS 9.8 (critical), 2025-07-28: In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions
• CVE-2025-54528 - CVSS 8.8 (high), 2025-07-28: In JetBrains TeamCity before 2025.07 a CSRF was possible in GitHub App connection flow
• CVE-2025-52878 - CVSS 4.3 (medium), 2025-06-23: In JetBrains TeamCity before 2025.03.3 usernames were exposed to the users without proper permissions
• CVE-2025-52877 - CVSS 4.8 (medium), 2025-06-23: In JetBrains TeamCity before 2025.03.3 reflected XSS on diskUsageBuildsStats page was possible
• CVE-2025-52876 - CVSS 5.4 (medium), 2025-06-23: In JetBrains TeamCity before 2025.03.3 reflected XSS on the favoriteIcon page was possible
• CVE-2025-52879 - CVSS 4.8 (medium), 2025-06-23: In JetBrains TeamCity before 2025.03.3 reflected XSS in the NPM Registry integration was possible
• CVE-2025-52875 - CVSS 5.4 (medium), 2025-06-23: In JetBrains TeamCity before 2025.03.3 a DOM-based XSS at the Performance Monitor page was possible
• CVE-2025-47851 - CVSS 5.4 (medium), 2025-05-20: In JetBrains TeamCity before 2025.03.2 stored XSS via GitHub Checks Webhook was possible
• CVE-2025-47854 - CVSS 6.1 (medium), 2025-05-20: In JetBrains TeamCity before 2025.03.2 open redirect was possible on editing VCS Root page
• CVE-2025-47853 - CVSS 5.4 (medium), 2025-05-20: In JetBrains TeamCity before 2025.03.2 stored XSS via Jira integration was possible
• CVE-2025-47852 - CVSS 5.4 (medium), 2025-05-20: In JetBrains TeamCity before 2025.03.2 stored XSS via YouTrack integration was possible
• CVE-2025-46432 - CVSS 6.5 (medium), 2025-04-25: In JetBrains TeamCity before 2025.03.1 base64-encoded credentials could be exposed in build logs
• CVE-2025-46618 - CVSS 6.1 (medium), 2025-04-25: In JetBrains TeamCity before 2025.03.1 stored XSS was possible on Data Directory tab
• CVE-2025-46433 - CVSS 9.8 (critical), 2025-04-25: In JetBrains TeamCity before 2025.03.1 improper path validation in loggingPreset parameter was possible
• CVE-2025-31141 - CVSS 7.5 (high), 2025-03-27: In JetBrains TeamCity before 2025.03 exception could lead to credential leakage on Cloud Profiles page
• CVE-2025-31139 - CVSS 6.5 (medium), 2025-03-27: In JetBrains TeamCity before 2025.03 base64 encoded password could be exposed in build log
• CVE-2025-31140 - CVSS 6.1 (medium), 2025-03-27: In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page
• CVE-2025-26493 - CVSS 6.1 (medium), 2025-02-11: In JetBrains TeamCity before 2024.12.2 several DOM-based XSS were possible on the Code Inspection Report tab
• CVE-2025-26492 - CVSS 9.1 (critical), 2025-02-11: In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources
• CVE-2025-24461 - CVSS 6.5 (medium), 2025-01-21: In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpoint
• CVE-2025-24460 - CVSS 4.3 (medium), 2025-01-21: In JetBrains TeamCity before 2024.12.1 improper access control allowed to see Projects’ names in the agent pool
• CVE-2025-24459 - CVSS 6.1 (medium), 2025-01-21: In JetBrains TeamCity before 2024.12.1 reflected XSS was possible on the Vault Connection page
• CVE-2024-56355 - CVSS 5.4 (medium), 2024-12-20: In JetBrains TeamCity before 2024.12 missing Content-Type header in RemoteBuildLogController response could lead to XSS
• CVE-2024-56354 - CVSS 5.5 (medium), 2024-12-20: In JetBrains TeamCity before 2024.12 password field value were accessible to users with view settings permission
• CVE-2024-56353 - CVSS 6.5 (medium), 2024-12-20: In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies
• CVE-2024-56356 - CVSS 7.1 (high), 2024-12-20: In JetBrains TeamCity before 2024.12 insecure XMLParser configuration could lead to potential XXE attack
• CVE-2024-56349 - CVSS 5.3 (medium), 2024-12-20: In JetBrains TeamCity before 2024.12 improper access control allowed unauthorized users to modify build logs
• CVE-2024-56352 - CVSS 5.4 (medium), 2024-12-20: In JetBrains TeamCity before 2024.12 stored XSS was possible via image name on the agent details page
• CVE-2024-56351 - CVSS 8.8 (high), 2024-12-20: In JetBrains TeamCity before 2024.12 access tokens were not revoked after removing user roles
• CVE-2024-56350 - CVSS 4.3 (medium), 2024-12-20: In JetBrains TeamCity before 2024.12 build credentials allowed unauthorized viewing of projects
• CVE-2024-56348 - CVSS 4.3 (medium), 2024-12-20: In JetBrains TeamCity before 2024.12 improper access control allowed viewing details of unauthorized agents
• CVE-2024-47951 - CVSS 5.4 (medium), 2024-10-08: In JetBrains TeamCity before 2024.07.3 stored XSS was possible via server global settings
• CVE-2024-47161 - CVSS 6.5 (medium), 2024-10-08: In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API
• CVE-2024-47950 - CVSS 5.4 (medium), 2024-10-08: In JetBrains TeamCity before 2024.07.3 stored XSS was possible in Backup configuration settings
• CVE-2024-47949 - CVSS 7.5 (high), 2024-10-08: In JetBrains TeamCity before 2024.07.3 path traversal allowed backup file write to arbitrary location
• CVE-2024-47948 - CVSS 7.5 (high), 2024-10-08: In JetBrains TeamCity before 2024.07.3 path traversal leading to information disclosure was possible via server backups
• CVE-2024-43807 - CVSS 5.4 (medium), 2024-08-16: In JetBrains TeamCity before 2024.07.1 multiple stored XSS was possible on Clouds page
• CVE-2024-43810 - CVSS 5.4 (medium), 2024-08-16: In JetBrains TeamCity before 2024.07.1 reflected XSS was possible in the AWS Core plugin
• CVE-2024-43809 - CVSS 6.1 (medium), 2024-08-16: In JetBrains TeamCity before 2024.07.1 reflected XSS was possible on the agentPushPreset page
• CVE-2024-43808 - CVSS 5.4 (medium), 2024-08-16: In JetBrains TeamCity before 2024.07.1 self XSS was possible in the HashiCorp Vault plugin
• CVE-2024-43114 - CVSS 7.8 (high), 2024-08-06: In JetBrains TeamCity before 2024.07.1 possible privilege escalation due to incorrect directory permissions
• CVE-2024-41828 - CVSS 6.5 (medium), 2024-07-22: In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time
• CVE-2024-41827 - CVSS 9.8 (critical), 2024-07-22: In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expiration
• CVE-2024-41829 - CVSS 7.5 (high), 2024-07-22: In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connection