Introduction
A recently patched flaw in JetBrains TeamCity On Premises allows authenticated users to expose internal server API endpoints to completely unauthorized parties, earning a CVSS score of 8.2. For organizations running TeamCity as the backbone of their CI/CD pipelines, this vulnerability quietly turns a low privilege or even guest account into a mechanism for bypassing authentication on critical API surfaces.
TeamCity is JetBrains' Continuous Integration and Deployment server, designed to automate the process of building, testing, and releasing software. It is widely adopted across enterprises and development teams globally, serving as a central orchestration point for software delivery. Because CI/CD servers hold privileged access to source code, deployment environments, and infrastructure credentials, vulnerabilities in these platforms carry significant supply chain risk.
Technical Information
CVE-2026-44413 is rooted in CWE-306: Missing Authentication for Critical Function. The core issue is that certain internal TeamCity server API endpoints lack proper authentication enforcement. When an authenticated user (even one with minimal privileges) performs actions on the server, parts of the internal API become accessible to unauthenticated parties under specific network conditions.
Prerequisites for Exploitation
Exploitation requires two conditions to be met simultaneously:
-
An authenticated session: The attacker needs access to a TeamCity account. This can be a standard user account or, critically, the guest user account if guest access is enabled on the server. Guest access is a common configuration in development environments where teams want to provide read access to build results without requiring individual logins.
-
A permissive network environment: The vulnerability is exploitable when one of the following environmental conditions exists:
- The firewall permits inbound connections on ports other than the standard HTTP or HTTPS ports used by TeamCity.
- Build agents are running on the same host as the TeamCity server.
Attack Flow
Based on the available disclosures, the exploitation sequence works as follows:
- The attacker authenticates to the TeamCity server using any valid account, including a guest account if that feature is enabled.
- Through their authenticated session, the attacker triggers actions that expose portions of the internal server API.
- Because the exposed API endpoints lack proper authentication checks (the CWE-306 root cause), these endpoints become reachable by unauthenticated users.
- In environments where non-standard ports are open or build agents share the server host, the exposed API surface is network-reachable, allowing unauthorized access to server functionality.
Risk Assessment by Deployment Scenario
The severity of this vulnerability varies significantly based on the deployment architecture:
| Deployment Scenario | Exploitation Preconditions | Relative Risk Level |
|---|---|---|
| Internet facing server | Public access enabled with guest account active | High |
| Internal server with custom ports | Authenticated network access and non-standard inbound ports permitted | Medium |
| Co-hosted build agents | Authenticated user access and agents running on the server host | Medium |
The exact API endpoints that become exposed have not been publicly disclosed by JetBrains. There is also no public proof of concept code or detailed CVSS vector string in the current disclosures. Organizations should operate under the assumption that any exposed API endpoint could lead to sensitive data disclosure or pipeline manipulation.
It is worth noting that TeamCity Cloud environments are not affected and require no action.
Patch Information
JetBrains addressed CVE-2026-44413 with two concrete patch delivery mechanisms, both made available on May 11, 2026.
Primary Fix: TeamCity 2026.1
The definitive remediation ships in TeamCity On Premises version 2026.1. The NVD description confirms the vulnerability existed "before 2026.1" and also before the maintenance release 2025.11.5, indicating JetBrains back-ported the fix to the previous release branch as well. The underlying weakness is classified as CWE-306, so the patch introduces proper authentication enforcement on the previously exposed internal server API surface, ensuring that unauthenticated parties can no longer reach those endpoints even when an authenticated user's actions would have otherwise exposed them.
Administrators can obtain the fixed version from the JetBrains download page or use the built-in automatic update mechanism within TeamCity itself.
Back-port Fix: Security Patch Plugin for TeamCity 2017.1+
For environments that cannot immediately upgrade to 2026.1, JetBrains simultaneously released a standalone security patch plugin. This plugin is compatible with every TeamCity On Premises version from 2017.1 onward and is available as a direct download:
https://download.jetbrains.com/teamcity/plugins/internal/fix_CVE_2026_44413.zip
The plugin is scoped exclusively to the CVE-2026-44413 vulnerability and does not bundle any other fixes. There are two ways to acquire it:
- Manual download and install: Download the ZIP above and install it through the TeamCity web UI (Administration, then Plugins).
- Automatic notification (TeamCity 2024.03+): Newer TeamCity instances automatically download available security patches and surface them to administrators under Administration | Updates, then Available security updates, where they can be reviewed and applied.
An important behavioral difference exists depending on the server version: for installations running TeamCity 2017.1 through 2018.1, a full server restart is required after installing the plugin. Starting with TeamCity 2018.2, the plugin can be enabled at runtime without any downtime.
The JetBrains advisory emphasizes that the security patch plugin is a targeted stop-gap. Upgrading to 2026.1 is recommended to receive the full set of security hardening that ships with the latest release.
Interim Network Controls
If immediate patching is not feasible, organizations should implement the following defensive measures:
- Temporarily restrict external access for publicly accessible servers over the internet.
- Require connections through a VPN or implement an additional security layer to prevent unauthorized access to the login screen or REST API.
- Restrict inbound network access to only required ports.
- Run TeamCity servers on dedicated hosts, separate from build agents.
Affected Systems and Versions
The vulnerability affects the following:
- JetBrains TeamCity On Premises: All versions before 2026.1
- JetBrains TeamCity On Premises: All versions in the 2025.11.x branch before 2025.11.5
This means every TeamCity On Premises installation from the earliest versions through 2025.11.4 is vulnerable.
Not affected:
- TeamCity Cloud instances are not affected and require no action.
Vulnerable configurations include:
- Servers with guest access enabled
- Servers where firewalls permit inbound connections on non-standard ports (beyond the configured HTTP/HTTPS ports)
- Deployments where build agents run on the same host as the TeamCity server
Vendor Security History
JetBrains has faced prior security scrutiny around TeamCity. In March and April 2024, CISA added two TeamCity vulnerabilities, CVE-2024-27198 and CVE-2024-27199, to its Known Exploited Vulnerabilities (KEV) catalog due to confirmed active exploitation in the wild. This history of threat actor interest in TeamCity infrastructure makes prompt patching of CVE-2026-44413 particularly important.
The vulnerability was reported privately to JetBrains on April 30, 2026 by security researcher Martin Orem. JetBrains responded quickly, releasing patches and the dedicated security plugin within approximately 11 days of the initial report.
