TeamCity Perforce Connection Remote Code Execution Vulnerability

In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings

In JetBrains TeamCity before 2026.1.3, 2025.11.7 unauthenticated remote code execution was possible via the agent polling protocol

Authenticated Users May Expose TeamCity Server API to Unauthorized Access

In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access

Deserialization Vulnerability Allows Remote Code Execution in TeamCity

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 remote code execution via a whitelist bypass in the build messages protocol was possible

Stored Cross‑Site Scripting in Classic Project Overview of JetBrains TeamCity

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic project overview was possible

Stored Cross‑Site Scripting in TeamCity Build Log

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible

Kotlin DSL Sandbox Escape Allows Remote Code Execution in JetBrains TeamCity

In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible

Local Repository Access via Unvalidated Git Submodule URLs

In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server

In JetBrains TeamCity before 2025.11 improper access control could expose GitHub App token's metadata

Authenticated Command Execution via CRLF Injection in TeamCity Pipeline Git Settings

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings

TeamCity Sandbox Escape via Kotlin DSL Settings Enables Code Execution

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 sandbox escape leading to code execution was possible via the versioned settings Kotlin DSL

Administrator Account Takeover via Password Reset in JetBrains TeamCity

In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset

In JetBrains TeamCity before 2026.1.2, 2025.11.6 сode execution via Kotlin DSL sandbox escape was possible

In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible

Stored XSS via agent‑reported data on TeamCity cloud profile page

In JetBrains TeamCity before 2026.1.2 stored XSS on the cloud profile page was possible via agent-reported data

In JetBrains TeamCity before 2026.1.2 arbitrary file access was possible via the Perforce VCS integration

In JetBrains TeamCity before 2026.1.2 stored XSS via unauthenticated agent registration was possible

In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks

Missing Authorization Allows Project Developers to Add Build Parameters

In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations

In JetBrains TeamCity between 2022.10 and 2022.10.1 connecting to AWS using the "Default Credential Provider Chain" allowed TeamCity project administrators to access AWS resources normally limited to TeamCity system administrators.