CVE-2026-59796: JetBrains TeamCity Pipeline Modification Vulnerability (CVSS 8.1)

Technical summary

CVE-2026-59796 stems from improper permission validation in TeamCity's pipeline modification endpoints (CWE-862: Missing Authorization). The vulnerability permits authenticated users—including those with restricted roles—to modify pipeline definitions that should be protected by role-based access controls. The network-based attack vector (AV:N) and low attack complexity (AC:L) mean an attacker needs only valid credentials and network access to exploit this flaw. The CVSS 3.1 score of 8.1 reflects high impact to both confidentiality and integrity, though availability is not compromised.

Business impact

Pipeline modification by unauthorized users directly threatens build integrity and software supply chain security. An attacker could inject malicious compilation flags, steal build artifacts or credentials stored in the CI/CD environment, modify deployment targets, or insert backdoors into releases. For organizations using TeamCity as a central build orchestration platform, this vulnerability could affect every artifact produced until detection and remediation. Customers of software built via compromised pipelines face downstream risk.

Affected systems

JetBrains TeamCity versions prior to 2026.1.2 are affected. Organizations running TeamCity on-premises or via JetBrains Cloud should verify their current version and upgrade immediately. The vulnerability affects all deployments regardless of scale or network configuration, though exploitation requires valid TeamCity credentials.

Exploitability

This vulnerability is not currently on the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating no observed in-the-wild exploitation as of the publication date. However, exploitability is moderately high because: (1) attackers with employee or contractor credentials can exploit it without additional technical barriers, (2) the attack is straightforward once authenticated, and (3) typical CI/CD environments contain high-value targets. Insider threats and compromised employee accounts pose immediate risk.

Remediation

Upgrade JetBrains TeamCity to version 2026.1.2 or later. This release includes corrected permission checks on pipeline modification operations. Verify the upgrade in your release notes and test in a non-production environment first. After patching, conduct an access control audit to identify unauthorized pipeline changes made during the vulnerability window.

Patch guidance

1. Review your current TeamCity version via Administration > About. 2. Back up your TeamCity server configuration and database before upgrading. 3. Download and install JetBrains TeamCity 2026.1.2 from the official JetBrains website, following their upgrade documentation. 4. Test pipeline execution and permission restrictions in a staging environment before deploying to production. 5. Monitor build logs and pipeline modification history for suspicious changes made prior to the patch date. 6. Consider re-authenticating high-privilege accounts and rotating any credentials that may have been exposed in pipelines.

Detection guidance

Search TeamCity audit logs for unauthorized pipeline modification attempts or successful modifications by users without expected permissions. Look for build configuration edits, step additions, or variable changes initiated by non-administrative accounts. Monitor for unusual build step commands (e.g., credential exfiltration, reverse shells) that may indicate post-exploitation activity. If running TeamCity 2026.1.2 or later, implement alerts on permission denial events to catch future exploitation attempts.

Why prioritize this

This HIGH-severity vulnerability merits immediate action because it directly undermines software supply chain integrity. The combination of low attack complexity, authenticated access requirement, and high impact to confidentiality and integrity makes it a prime target for insider threats and compromised credentials. CI/CD systems are high-value attack targets; any permission bypass here can affect production deployments and customer trust.

Risk score, explained

The CVSS 3.1 score of 8.1 (HIGH) reflects an authenticated attacker's ability to significantly compromise pipeline integrity and confidentiality without affecting system availability. The attack requires valid credentials (PR:L), but once authenticated, the attacker faces no additional complexity (AC:L) and can exploit the vulnerability over the network (AV:N). The unscoped impact (S:U) and absence of availability harm still allow exploitation to cause critical business damage.

Frequently asked questions