Jetbrains Teamcity vulnerabilities

CVE-2022-36321 [MEDIUM] CWE-532 CVE-2022-36321: In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some In JetBrains TeamCity before 2022.04.2 the private SSH key could be written to the build log in some cases

CVE-2024-36364 [MEDIUM] CWE-863 CVE-2024-36364: In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in P In JetBrains TeamCity before 2022.04.7, 2022.10.6, 2023.05.6, 2023.11.5 improper access control in Pull Requests and Commit status publisher build features was possible

CVE-2025-24461 [MEDIUM] CWE-862 CVE-2025-24461: In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions w In JetBrains TeamCity before 2024.12.1 decryption of connection secrets without proper permissions was possible via Test Connection endpoint

CVE-2024-56353 [MEDIUM] CWE-212 CVE-2024-56353: In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies In JetBrains TeamCity before 2024.12 backup file exposed user credentials and session cookies

CVE-2024-47161 [MEDIUM] CWE-522 CVE-2024-47161: In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API In JetBrains TeamCity before 2024.07.3 password could be exposed via Sonar runner REST API

CVE-2024-41828 [MEDIUM] CWE-208 CVE-2024-41828: In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant time

CVE-2026-49376 [MEDIUM] CWE-863 CVE-2026-49376: In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin

CVE-2019-12841 [HIGH] CWE-20 CVE-2019-12841: Incorrect handling of user input in ZIP extraction was detected in JetBrains TeamCity. The issue was Incorrect handling of user input in ZIP extraction was detected in JetBrains TeamCity. The issue was fixed in TeamCity 2018.2.2.

CVE-2019-15042 [HIGH] CWE-295 CVE-2019-15042: An issue was discovered in JetBrains TeamCity 2018.2.4. It had no SSL certificate validation for som An issue was discovered in JetBrains TeamCity 2018.2.4. It had no SSL certificate validation for some external https connections. This was fixed in TeamCity 2019.1.

CVE-2023-38064 [MEDIUM] CWE-532 CVE-2023-38064: In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be writte In JetBrains TeamCity before 2023.05.1 build chain parameters of the "password" type could be written to the agent log

CVE-2023-38067 [MEDIUM] CWE-532 CVE-2023-38067: In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to t In JetBrains TeamCity before 2023.05.1 build parameters of the "password" type could be written to the agent log

CVE-2024-31134 [MEDIUM] CWE-863 CVE-2024-31134: In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could re In JetBrains TeamCity before 2024.03 authenticated users without administrative permissions could register other users when self-registration was disabled

CVE-2024-41824 [MEDIUM] CWE-532 CVE-2024-41824: In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific cases

CVE-2025-68165 [MEDIUM] CWE-79 CVE-2025-68165: In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup In JetBrains TeamCity before 2025.11 reflected XSS was possible on VCS Root setup

CVE-2022-24337 [MEDIUM] CWE-276 CVE-2022-24337: In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked ap In JetBrains TeamCity before 2021.2, health items of pull requests were shown to users who lacked appropriate permissions.

CVE-2022-24333 [MEDIUM] CWE-918 CVE-2022-24333: In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible. In JetBrains TeamCity before 2021.2, blind SSRF via an XML-RPC call was possible.

CVE-2020-15828 [MEDIUM] CVE-2020-15828: In JetBrains TeamCity before 2020.1.1, project parameter values can be retrieved by a user without a In JetBrains TeamCity before 2020.1.1, project parameter values can be retrieved by a user without appropriate permissions.

CVE-2025-57732 [MEDIUM] CWE-282 CVE-2025-57732: In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory In JetBrains TeamCity before 2025.07.1 privilege escalation was possible due to incorrect directory ownership

CVE-2020-11688 [HIGH] CWE-613 CVE-2020-11688: In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his ses In JetBrains TeamCity before 2019.2.1, the application state is kept alive after a user ends his session.

CVE-2022-24336 [MEDIUM] CVE-2022-24336: In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an In JetBrains TeamCity before 2021.2.1, an unauthenticated attacker can cancel running builds via an XML-RPC request to the TeamCity server.