Is CVE-2026-49378 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-49378 being exploited in the wild.

How severe is CVE-2026-49378?

Medium severity, with a CVSS score of 4.3, published 29 May 2026.

Which products and versions are affected?

Jetbrains TeamCity before 2026.1.

Is there a fix for CVE-2026-49378?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-49378 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-49378?

Check whether you run Jetbrains TeamCity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-49378: JetBrains TeamCity credential exposure via parameter autocompletion

CVE-2026-49378 · Severity: medium · CVSS 4.3 · Published 2026-05-29

JetBrains TeamCity, a platform used by software teams to automate building and testing code, contained a flaw where sensitive credential information was inadvertently visible. Specifically, these credentials could be exposed to authorized users through the user interface's autocompletion feature. This could allow internal users with basic access to view sensitive keys or passwords they are not supposed to see, potentially leading to unauthorized access to other connected systems.

Technologies: Jetbrains TeamCity. Vendors: Jetbrains.

Quick answers

Is CVE-2026-49378 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-49378 being exploited in the wild.
How severe is CVE-2026-49378?: Medium severity, with a CVSS score of 4.3, published 29 May 2026.
Which products and versions are affected?: Jetbrains TeamCity before 2026.1.
Is there a fix for CVE-2026-49378?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-49378 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-49378?: Check whether you run Jetbrains TeamCity at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A missing authorization vulnerability (CWE-862) in JetBrains TeamCity before version 2026.1 allowed the exposure of sensitive credential parameters. The flaw exists in the parameter autocompletion component of the web interface. A remote attacker with low-privileged authenticated access could trigger autocompletion suggestions to reveal sensitive credential strings that should otherwise be masked or restricted. This is categorized with a CVSS score of 4.3, reflecting a partial loss of confidentiality. The issue is resolved in TeamCity version 2026.1.

Affected products

JetBrains TeamCity before 2026.1

Timeline

2026-05-29: disclosed
2026-05-29: advisory

References

https://www.jetbrains.com/privacy-security/issues-fixed/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.