JetBrains Warns of Critical Authentication Bypass in TeamCity On-Premises Enabling Remote Code Execution

JetBrains has issued an advisory for a critical authentication bypass vulnerability in TeamCity On-Premises, according to a report from BleepingComputer. JetBrains states the flaw could be exploited to achieve remote code execution (RCE) on affected installations.

Why It Matters

TeamCity is a widely used CI/CD server, and self-hosted TeamCity On-Premises instances often have privileged access to source code repositories, build agents, artifact repositories, and deployment pipelines. An authentication bypass leading to RCE on this class of system is severe: successful exploitation could let an unauthenticated attacker execute arbitrary code on the build server, potentially enabling source code theft, build/artifact tampering (a supply-chain risk), lateral movement into connected infrastructure, or credential and secrets exposure stored in the CI/CD environment. Organizations running internet-facing or otherwise exposed TeamCity On-Premises servers are most directly at risk; TeamCity Cloud is not described as affected in the report.

What Defenders Should Do Now

• Identify all TeamCity On-Premises instances in your environment and check their exposure (internet-facing vs. internal-only).
• Apply JetBrains' patched version or advised mitigation as soon as it is available and validated for your environment.
• Until patched, consider restricting network access to TeamCity web interfaces (VPN/allowlisting) and reviewing authentication logs for anomalous access attempts.
• Hunt for signs of unexpected process execution originating from the TeamCity server process, unusual outbound connections from build agents, and unexpected changes to build configurations, plugins, or artifacts.
• Review recent build and deployment activity for unauthorized changes, since CI/CD compromise can be a vector into downstream production systems.

This is developing intel based on an initial vendor advisory as reported by BleepingComputer; full technical details (such as an assigned CVE identifier, affected version ranges, and proof-of-concept status) were not included in the source material reviewed here. Defenders should consult JetBrains' official advisory directly for authoritative patching guidance. Original report: BleepingComputer.