Jetbrains Teamcity vulnerabilities

284 known vulnerabilities affecting jetbrains/teamcity.

Total CVEs

284

CISA KEV

actively exploited

Public exploits

Exploited in wild

Severity breakdown

CRITICAL30HIGH59MEDIUM186LOW9

Vulnerabilities

SortPage 3 of 15

CVE-2022-24342P3HIGHCVSS 8.8fixed in 2021.2.12022-02-25

CVE-2022-24342 [HIGH] CWE-352 CVE-2022-24342: In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible. In JetBrains TeamCity before 2021.2.1, URL injection leading to CSRF was possible.

nvd

CVE-2026-44413P3HIGHCVSS 7.5fixed in 2025.11.5fixed in 2026.1 2025.11.52026-05-11

CVE-2026-44413 [HIGH] CWE-306 CVE-2026-44413: In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unautho In JetBrains TeamCity before 2026.1 2025.11.5 authenticated users could expose server API to unauthorised access

nvd

CVE-2025-54530P3CRITICALCVSS 9.8fixed in 2025.072025-07-28

CVE-2025-54530 [CRITICAL] CWE-276 CVE-2025-54530: In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory pe In JetBrains TeamCity before 2025.07 privilege escalation was possible due to incorrect directory permissions

nvd

CVE-2026-59796P3HIGHCVSS 8.1fixed in 2026.1.22026-07-10

CVE-2026-59796 [HIGH] CWE-862 CVE-2026-59796: In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks

nvd

CVE-2026-106219P3HIGHCVSS 7.5fixed in 2026.2.12026-10-06

CVE-2026-106219 [HIGH] CWE-73 CVE-2026-106219: In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server

nvd

CVE-2021-43200P3CRITICALCVSS 9.8fixed in 2021.22021-11-09

CVE-2021-43200 [CRITICAL] CVE-2021-43200: In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insuff In JetBrains TeamCity before 2021.1.2, permission checks in the Agent Push functionality were insufficient.

nvd

CVE-2026-49374P3HIGHCVSS 7.6fixed in 2026.12026-05-29

CVE-2026-49374 [HIGH] CWE-862 CVE-2026-49374: In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameter In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters

nvd

CVE-2026-49372P3HIGHCVSS 7.5fixed in 2025.11.5fixed in 2026.1, 2025.11.52026-05-29

CVE-2026-49372 [HIGH] CWE-918 CVE-2026-49372: In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible

nvd

CVE-2025-26492P3CRITICALCVSS 9.1fixed in 2024.12.22025-02-11

CVE-2025-26492 [CRITICAL] CWE-522 CVE-2025-26492: In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitiv In JetBrains TeamCity before 2024.12.2 improper Kubernetes connection settings could expose sensitive resources

nvd

CVE-2024-24942P3MEDIUMCVSS 5.3fixed in 2023.11.32024-02-06

CVE-2024-24942 [MEDIUM] CWE-23 CVE-2024-24942: In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives In JetBrains TeamCity before 2023.11.3 path traversal allowed reading data within JAR archives

nvd

CVE-2024-36377P3HIGHCVSS 8.1fixed in 2024.03.22024-05-29

CVE-2024-36377 [HIGH] CWE-863 CVE-2024-36377: In JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissions In JetBrains TeamCity before 2024.03.2 certain TeamCity API endpoints did not check user permissions

nvd

CVE-2025-59457P3HIGHCVSS 7.7fixed in 2025.07.22025-09-17

CVE-2025-59457 [HIGH] CWE-183 CVE-2025-59457: In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Wind In JetBrains TeamCity before 2025.07.2 missing Git URL validation allowed credential leakage on Windows

nvd

CVE-2021-37544P3CRITICALCVSS 9.8fixed in 2020.2.42021-08-06

CVE-2021-37544 [CRITICAL] CWE-502 CVE-2021-37544: In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization. In JetBrains TeamCity before 2020.2.4, there was an insecure deserialization.

nvd

CVE-2021-43202P3CRITICALCVSS 9.8fixed in 2021.1.32021-11-30

CVE-2021-43202 [CRITICAL] CVE-2021-43202: In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases. In JetBrains TeamCity before 2021.1.3, the X-Frame-Options header is missing in some cases.

nvd

CVE-2022-24340P3CRITICALCVSS 9.8fixed in 2021.2.12022-02-25

CVE-2022-24340 [CRITICAL] CWE-611 CVE-2022-24340: In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible In JetBrains TeamCity before 2021.2.1, XXE during the parsing of the configuration file was possible.

nvd

CVE-2024-36365P3HIGHCVSS 8.1fixed in 2022.04.7≥ 2022.10, < 2022.10.6+4 more2024-05-29

CVE-2024-36365 [HIGH] CWE-863 CVE-2024-36365: In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party age In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5, 2024.03.2 a third-party agent could impersonate a cloud agent

nvd

CVE-2021-37545P3HIGHCVSS 7.5fixed in 2021.12021-08-06

CVE-2021-37545 [HIGH] CWE-287 CVE-2021-37545: In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were ma In JetBrains TeamCity before 2021.1.1, insufficient authentication checks for agent requests were made.

nvd

CVE-2025-31140P3MEDIUMCVSS 6.1fixed in 2025.032025-03-27

CVE-2025-31140 [MEDIUM] CWE-79 CVE-2025-31140: In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page In JetBrains TeamCity before 2025.03 stored XSS was possible on Cloud Profiles page

nvd

CVE-2022-48342P3CRITICALCVSS 9.8fixed in 2022.10.22023-02-23

CVE-2022-48342 [CRITICAL] CWE-1188 CVE-2022-48342: In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents. In JetBrains TeamCity before 2022.10.2 jVMTI was enabled by default on agents.

nvd

CVE-2021-31912P3HIGHCVSS 8.8fixed in 2020.2.32021-05-11

CVE-2021-31912 [HIGH] CWE-640 CVE-2021-31912: In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password r In JetBrains TeamCity before 2020.2.3, account takeover was potentially possible during a password reset.

nvd

← Previous3 / 15Next →