WID-SEC-W-2026-1758

csafDEcert_bund

DeutschShown in its original language — a full translation is planned for a future version.

JetBrains TeamCity: Mehrere Schwachstellen

view advisory published 2026-05-31

Ein Angreifer kann mehrere Schwachstellen in JetBrains TeamCity ausnutzen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, und um beliebigen Programmcode auszuführen.

01

describes (11)

Related CVEs.

IDseverity exploitable
CVE-2026-49381USmedium4.8—
In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible
CVE-2026-49380USmedium6.1—
In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible
CVE-2026-49379US——
In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names
CVE-2026-49378US—OT elevated—
In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion
CVE-2026-49377US——
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
CVE-2026-49376US—OT elevated—
In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin
CVE-2026-49375US——
In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page
CVE-2026-49374US—OT elevated—
In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters
CVE-2026-49373UShigh8.8—
In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings
CVE-2026-49372US——
In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible
CVE-2026-49371UShigh8.2—
In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible
02

references

External citations — patches, advisories, analysis.

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan