CVE-2026-49374: JetBrains TeamCity Build Parameter Authorization Bypass

Technical summary

CVE-2026-49374 stems from improper permission validation in TeamCity's build configuration parameter handling. The vulnerability allows users with legitimate but restricted access (PR:L in the CVSS vector) to bypass authorization controls and read build configuration parameters across projects or contexts where they lack explicit permission. The issue resides in how TeamCity enforces role-based access controls on sensitive configuration endpoints, permitting information disclosure while also enabling limited modification capabilities.

Business impact

Organizations using TeamCity for CI/CD orchestration face credential exposure and intellectual property leakage. Build parameters commonly store API keys, database credentials, deployment tokens, and other secrets tied to production and development environments. Compromised credentials can escalate to lateral movement, unauthorized deployments, or sabotage of the build pipeline. The combination of confidentiality and integrity impacts elevates risk in regulated environments requiring audit trails and access controls.

Affected systems

JetBrains TeamCity installations before version 2026.1 are vulnerable. This includes all 2025.x releases and earlier versions. Organizations should verify their deployed TeamCity version through the Administration > About page or via version inspection endpoints.

Exploitability

Exploitation requires valid TeamCity credentials, reflecting the PR:L prerequisite. An attacker cannot exploit this remotely without authentication. However, the attack vector is network-based (AV:N), meaning exploitation can occur from any network location once an account is compromised or obtained. The barrier to exploitation is low complexity (AC:L), making this practical for attackers with basic access.

Remediation

Upgrade TeamCity to version 2026.1 or later. JetBrains has patched the permission validation logic in this release. Organizations unable to upgrade immediately should review audit logs for suspicious parameter access patterns and rotate credentials stored in build configurations as a precautionary measure.

Patch guidance

Apply JetBrains TeamCity 2026.1 or newer. Verify the patch by confirming the version in Administration settings post-update. Test in a staging environment before production rollout to ensure no compatibility issues with existing build jobs or plugins. Check the JetBrains security advisory for any noted breaking changes or migration steps.

Detection guidance

Monitor TeamCity access logs for unusual parameter read operations by users with restricted roles. Audit trail entries showing users accessing build configuration pages outside their assigned projects warrant investigation. Set up alerts on authentication patterns combining successful logins with abnormal parameter API calls. Review build configuration change history for unexpected modifications coinciding with the vulnerability window.

Why prioritize this

This vulnerability merits prompt attention despite not yet appearing on the KEV catalog. The HIGH CVSS score (7.6) reflects meaningful confidentiality impact coupled with integrity and availability concerns. Build configuration parameters are prime targets for attackers seeking credential theft, and the authentication requirement, while present, is frequently satisfied through credential compromise or insider threats. Organizations relying on TeamCity for sensitive CI/CD workflows should prioritize patching.

Risk score, explained

The CVSS 3.1 score of 7.6 reflects: network accessibility (AV:N) permitting remote exploitation; low attack complexity (AC:L) requiring no special conditions; mandatory authentication (PR:L) providing a moderate barrier; high confidentiality impact from parameter disclosure (C:H); low integrity and availability impact (I:L, A:L) from partial modification capabilities. The score falls within the HIGH severity band, warranting rapid remediation.

Frequently asked questions