CVE-2026-59794: JetBrains TeamCity Stored XSS Vulnerability on Cloud Profile Page

Technical summary

CVE-2026-59794 is a stored XSS flaw (CWE-79) in JetBrains TeamCity's cloud profile page. The vulnerability exists because user-supplied data reported by agents is rendered without adequate sanitization or encoding. An authenticated actor can embed malicious JavaScript in agent-reported fields, which is stored server-side and executed in the browser context of subsequent users viewing the cloud profile. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N) reflects network accessibility, low attack complexity, requirement for login credentials, user interaction (victim must view the malicious profile), and high impact to confidentiality and integrity within the same security context.

Business impact

Stored XSS on an internal CI/CD platform like TeamCity can facilitate credential theft, lateral movement, or supply chain compromise. Attackers with valid accounts can craft payloads that harvest authentication cookies or tokens from build engineers and DevOps staff who review cloud profiles. In regulated environments, this could violate data protection obligations. The vulnerability also increases insider-threat risk if a disgruntled employee injects persistent malware into shared infrastructure.

Affected systems

JetBrains TeamCity versions prior to 2026.1.2 are vulnerable. On-premises and cloud-hosted installations are affected. The exposure is limited to authenticated users who can view cloud profile pages and to those with permissions to trigger or configure agent-reported data flows. Organizations running TeamCity 2026.1.2 or later are not affected.

Exploitability

Exploitation requires a valid TeamCity login, reducing the attack surface to insider threats and compromised internal accounts. No special privileges are needed—any authenticated user can potentially inject payloads. User interaction is mandatory; the attacker cannot execute the payload automatically. However, once stored, the malicious script persists and affects all subsequent viewers, making it a high-confidence persistence mechanism within a trusted environment. Public exploit code is not yet available, and the vulnerability is not tracked in the CISA KEV catalog.

Remediation

Upgrade TeamCity to version 2026.1.2 or later. This patch release includes input sanitization and output encoding fixes for agent-reported data on the cloud profile page. Organizations unable to upgrade immediately should restrict access to the cloud profile page via network controls or role-based access, and monitor audit logs for suspicious agent-reported data patterns.

Patch guidance

Apply JetBrains TeamCity 2026.1.2 as soon as feasible, prioritizing test environments first to validate compatibility with existing build configurations and plugins. Verify patch deployment by confirming the version string in TeamCity's About page or via REST API query. No rollback complications are expected, but test recovery procedures beforehand. Check the JetBrains advisory for any post-patch configuration changes required.

Detection guidance

Monitor TeamCity audit and activity logs for unusual agent-reported data submissions, particularly those containing HTML tags, JavaScript keywords, or encoded payloads. Web application firewalls or reverse proxies in front of TeamCity can flag POST/PUT requests to the cloud profile endpoint containing script-like content. Endpoint Detection and Response tools should alert on suspicious session activity from build engineers accessing cloud profiles shortly after suspicious data was reported. Search stored data for common XSS patterns (e.g., <script>, onerror=, eval) in agent fields.

Why prioritize this

This vulnerability scores 7.3 (HIGH) and merits urgent remediation because it enables stored malware persistence on a critical build platform accessible to development and operations staff. Exploit is feasible with minimal skill once a valid credential is obtained, and the blast radius includes credential compromise across the CI/CD supply chain. Although not yet in CISA's KEV catalog, the risk of insider abuse and lateral movement justifies treating it as a priority patch within 30 days.

Risk score, explained

The CVSS 3.1 score of 7.3 reflects the combination of network accessibility (AV:N), low attack complexity (AC:L), and high impact to confidentiality and integrity (C:H, I:H). The requirement for authenticated access (PR:L) and user interaction (UI:R) prevents a maximum severity rating. However, the stored nature of the vulnerability and its placement on a trusted internal platform elevates risk beyond a transient reflected XSS, as it affects multiple users and can facilitate supply chain attacks.

Frequently asked questions