JetBrains TeamCity CVE-2026-49373: Brief Summary of Argument Injection RCE via Perforce Connection Settings

Introduction

An argument injection flaw in JetBrains TeamCity's Perforce VCS integration lets authenticated users run arbitrary code on the build server by crafting malicious connection settings. Many organizations run their CI/CD pipelines on TeamCity. For them, this vulnerability (CVSS 7.1) is a direct path from a compromised or malicious developer account to full control over build infrastructure, source code, and deployment credentials.

This vulnerability was disclosed on 2026-05-29 alongside at least 10 other TeamCity CVEs, several of them rated High severity. A batch that size points to a broad security audit of the platform. It also continues a pattern set by an earlier Perforce integration flaw, CVE-2025-68164, which enabled port enumeration through the same connection test functionality. The new CVE raises the impact from information disclosure to full remote code execution.

Technical Information

Root Cause: CWE-88 Argument Injection

CVE-2026-49373 is classified under CWE-88: Improper Neutralization of Argument Delimiters in a Command. MITRE defines this weakness as a case where "the argument of a function that invokes a command processor" is not properly sanitized, which lets an attacker "modify command line arguments" and potentially "execute arbitrary commands or read and modify data anywhere on the system." CWE-88 is a child of CWE-77 (Command Injection). In this narrower variant, the attacker manipulates the arguments passed to an existing command invocation instead of injecting an entirely new command.

The Perforce Integration Attack Surface

TeamCity supports Perforce (Helix Core) as a VCS root type. When a user configures a Perforce VCS root, TeamCity collects connection parameters: the Perforce server address (P4PORT), username, password, workspace (client) name, and other settings. TeamCity ultimately passes these parameters to the Perforce command-line client (p4) when it checks out source code during builds.

The vulnerability exists because the Perforce connection settings fields were not properly sanitized for argument delimiter characters. When a connection parameter value contains special delimiter characters (such as spaces, quotes, or shell metacharacters), the command processor reads them as separate arguments instead of as part of a single parameter value. An attacker can use this to inject additional, attacker-controlled arguments into the p4 command invocation.

Exploitation Flow

The likely exploitation path has three steps:

1. An authenticated user with permissions to create or modify VCS root configurations in TeamCity crafts a malicious Perforce connection setting value that contains argument delimiters.
2. When TeamCity executes a build that references this VCS root, it passes the unsanitized value as part of the p4 command-line invocation.
3. The injected arguments change how the p4 command behaves, so the attacker can execute arbitrary code on the TeamCity server with the privileges of the TeamCity server process.

The authentication requirement matches TeamCity's permission model for VCS root configuration, but it does little to reduce the risk in practice. Compromised developer credentials, overly permissive role assignments, or insider threats can all provide the necessary access.

Escalation from CVE-2025-68164

A related vulnerability, CVE-2025-68164, was disclosed earlier and fixed in TeamCity 2025.11. It allowed port enumeration through the Perforce connection test functionality. A Low-severity information disclosure followed by a High-severity RCE in the same subsystem makes the case for thorough security remediation of VCS connection modules.

Supply Chain Implications

TeamCity orchestrates build and deployment pipelines, so an attacker with RCE on the server can:

• inject malicious code into build artifacts destined for production
• exfiltrate source code and secrets stored in build configurations
• move laterally using deployment credentials managed by the CI/CD system
• tamper with build logs to conceal evidence of compromise

Affected Systems and Versions

All versions of JetBrains TeamCity prior to 2026.1 that use Perforce VCS root configurations are affected. TeamCity 2026.1 includes the fix.

For organizations that cannot upgrade immediately, JetBrains provides a security patch plugin compatible with TeamCity versions 2017.1 and later.

CVE-2026-49373 was one of several TeamCity vulnerabilities in a coordinated disclosure:

Upgrading to TeamCity 2026.1 fixes all listed CVEs except CVE-2026-49371, which requires version 2026.1.1.

Vendor Security History

JetBrains has a documented record of security findings in TeamCity. Its VCS integration modules, for both Git and Perforce, have been a recurring source of vulnerabilities, including path traversal, credential leakage, and now argument injection.

The company self-reports vulnerabilities through [email protected], which points to a responsible disclosure posture. JetBrains also ships backward-compatible security patch plugins for older versions, so customers who cannot upgrade right away still receive critical fixes. In March 2026, JetBrains published a detailed blog post on the security risks of CI/CD plugin architectures, which shows the company is aware of the wider threats facing build infrastructure.

Still, this batch alone includes at least five High-severity CVEs disclosed at once. That volume suggests the platform's attack surface remains substantial and warrants continuous scrutiny from security teams.

References

• NVD: CVE-2026-49373
• JetBrains Fixed Security Issues
• JetBrains TeamCity Fixed Security Issues (Product Filtered)
• CWE-88: Improper Neutralization of Argument Delimiters in a Command (MITRE)
• CWE-77: Improper Neutralization of Special Elements used in a Command (MITRE)
• High Severity Security Issue Affecting TeamCity On Premises (CVE-2026-44413)
• TeamCity 2026.1 Release Announcement
• What's New in TeamCity 2026.1
• What Are The Security Risks of CI/CD Plugin Architectures? (JetBrains Blog)
• TeamCity Vulnerability CVE-2026-44413 (Help Net Security)
• Stormshield: Multiple Vulnerabilities in TeamCity