Critical TeamCity Auth Bypass Enables Remote Code Execution
Written by AI from the linked story. Not reviewed by an editor. How this works
A critical authentication bypass vulnerability (CVE-2026-63077) in JetBrains TeamCity On-Premises allows any attacker with HTTPS access to circumvent authentication entirely and execute arbitrary commands with server-level privileges — no credentials required. This is especially dangerous because TeamCity is a CI/CD platform, meaning a compromised server can be weaponized to inject malicious code into build pipelines and software supply chains. The root cause reflects a failure in secure authentication design combined with delayed patching exposure for on-premises users. Organizations running unpatched versions remain fully exposed until upgrades or plugin patches are applied, highlighting the critical importance of rapid response to vendor security advisories.
Tactical Insight
Immediate actions
- Upgrade all TeamCity On-Premises instances to version 2025.11.7 or 2026.1.3 immediately, or apply the vendor-supplied security patch plugin if upgrading is not yet possible.
- Restrict HTTPS access to TeamCity servers by placing them behind a VPN or firewall, limiting exposure to trusted IP ranges only.
- Audit TeamCity server logs for any suspicious authentication attempts or unexpected command execution activity that may indicate prior exploitation.
Long-term improvements
- Maintain a complete, up-to-date inventory of all on-premises software versions to ensure timely identification of vulnerable systems when advisories are published.
- Establish a formal emergency patching SLA (e.g., 24–48 hours) for critical-severity vulnerabilities affecting internet-facing or build infrastructure systems.
- Implement network segmentation to isolate CI/CD infrastructure from production environments, limiting blast radius in the event of a compromise.
Detection measures
- Deploy a vulnerability management tool that continuously monitors for newly disclosed CVEs affecting your software inventory and triggers automated alerts.
- Enable centralized logging and SIEM alerting for anomalous TeamCity activity, including unexpected process spawning or privilege escalation events.