Executive brief
JetBrains TeamCity, a popular platform for automating software builds and deployments, is affected by a security flaw in its build status functionality. An unauthorized attacker could use the server to make requests to internal systems that are not normally accessible from the internet. This could lead to the exposure of sensitive internal data or provide a foothold for further attacks within the corporate network.
Technical details
A Server-Side Request Forgery (SSRF) vulnerability (CWE-918) exists in JetBrains TeamCity versions prior to 2026.1 and 2025.11.5. The flaw is located within the build status functionality and can be triggered by an unauthenticated remote attacker. By sending a specially crafted request, an attacker can force the TeamCity server to initiate outbound requests to arbitrary internal or external IP addresses. This can be leveraged to bypass firewall restrictions, perform internal port scanning, or access sensitive metadata services and internal APIs. The issue has been addressed in TeamCity versions 2026.1 and 2025.11.5.
Affected products
- JetBrains TeamCity Before 2026.1, 2025.11.5
Timeline
- 2026-05-29: advisory: CVE-2026-49372 published by JetBrains and NVD.