{"id":16538,"date":"2026-07-31T10:52:26","date_gmt":"2026-07-31T10:52:26","guid":{"rendered":"https:\/\/newestek.com\/?p=16538"},"modified":"2026-07-31T10:52:26","modified_gmt":"2026-07-31T10:52:26","slug":"jetbrains-says-a-crafted-http-request-could-break-teamcity","status":"publish","type":"post","link":"https:\/\/newestek.com\/?p=16538","title":{"rendered":"JetBrains says a crafted HTTP request could break TeamCity"},"content":{"rendered":"
\n
\n
\n
\n
\n
\n
<\/div>\n<\/section>\n

JetBrains is warning of a critical security vulnerability in its TeamCity DevOps platform that could allow unauthenticated attackers to execute arbitrary operating system commands on vulnerable servers.<\/p>\n

\u201cIf exploited, this vulnerability may allow an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and execute arbitrary commands,\u201c the company said in a security advisory<\/a>.<\/p>\n

The flaw, tracked as CVE-2026-63077, affects all TeamCity On-Premises deployments and has been fixed in versions 2025.11.7 and 2026.1.3.<\/p>\n

JetBrains warned that the flaw potentially exposes build environments, stored credentials, and software supply chains. Customers unable to upgrade are advised to deploy a security patch plugin immediately.<\/p>\n

TeamCity Cloud customers are not required to take any action, the company reassured.<\/p>\n

<\/a>RCE achieved without authentication<\/h2>\n

According to JetBrains, the vulnerability resides in the TeamCity agent polling protocol, allowing an attacker with HTTP(S) access to bypass authentication and execute code with the privileges <\/a>of the TeamCity server process.<\/p>\n

The vulnerability carries a CVSS score of 9.8 out of 10 as it requires no authentication or user interaction, making internet-exposed TeamCity servers particularly attractive targets. Classified under CWE-502<\/a> (deserialization of unstructured data), the flaw can be used to send specially crafted data through the affected agent polling protocol to trigger remote code execution (RCE).<\/p>\n

\u201cDepending on the privileges granted to the TeamCity server process, a successful attack could expose TeamCity data, configurations, and stored credentials, modify server state, and potentially compromise the integrity of build artifacts and downstream CI\/CD pipelines,\u201d the company added.<\/p>\n

The issue was privately reported on July 10 by security researcher Antoni Tremblay through JetBrains\u2019 coordinated disclosure process.<\/p>\n

JetBrains said it had found no evidence of active exploitation at the time of publishing the advisory.<\/p>\n

<\/a>Developers have two mitigation paths<\/h2>\n

JetBrains is recommending that customers upgrade directly to TeamCity 2025.11.7 or 2026.1.3, both of which include a permanent fix for the vulnerability.<\/p>\n

Organizations unable to upgrade immediately can instead deploy a security patch plugin<\/a>, which is available for TeamCity versions 2017.1 and later. Servers running versions 2017.1 through 2018.1 require a restart after installing the plugin, while newer supported releases can enable the fix without restarting, the company added.<\/p>\n

The company also advised administrators whose TeamCity servers are publicly accessible to restrict external access if neither mitigation can be applied immediately.<\/p>\n

\u201cAs a general best practice, we strongly recommend limiting network access to TeamCity servers to trusted networks wherever possible,\u201d the company said. \u201cWe also recommend running the TeamCity server with the minimum operating system privileges required for normal operation.\u201d<\/p>\n

Given the vulnerability\u2019s pre-authentication nature and the history<\/a> of threat actors rapidly weaponizing TeamCity flaws, organizations running self-hosted CI\/CD infrastructure are advised to prioritize emergency patching over routine maintenance windows.<\/p>\n

The advisory also recommended running TeamCity servers on dedicated hosts separate from build agents, as per official instructions<\/a>.<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

JetBrains is warning of a critical security vulnerability in its TeamCity DevOps platform that could allow unauthenticated attackers to execute arbitrary operating system commands on vulnerable servers. \u201cIf exploited, this vulnerability may allow an unauthenticated attacker with HTTP(S) access to a TeamCity server to bypass authentication checks and execute arbitrary commands,\u201c the company said in a security advisory. The flaw, tracked as CVE-2026-63077, affects all… <\/p>\n

Read More<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[1],"tags":[],"class_list":["post-16538","post","type-post","status-publish","format-standard","hentry","category-uncategorized","is-cat-link-borders-light is-cat-link-rounded"],"_links":{"self":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16538","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=16538"}],"version-history":[{"count":0,"href":"https:\/\/newestek.com\/index.php?rest_route=\/wp\/v2\/posts\/16538\/revisions"}],"wp:attachment":[{"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=16538"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=16538"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/newestek.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=16538"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}