🏠/jetbrains/2026/05/11/High-Severity Security Issue Affecting TeamCity On-Premises (CVE-2026-44413) – Update to 2026.1 Now
📝 Резюме · 🧾 Транскрипт (формат) · 📄 Оригинал (4.6 KB)
https://blog.jetbrains.com/teamcity/2026/05/cve-2026-44413/

JetBrains: уязвимость высокой важности в TeamCity On-Premises (CVE-2026-44413)

Источник: https://blog.jetbrains.com/teamcity/2026/05/cve-2026-44413/

Краткое содержание

JetBrains публикует security-advisory: в TeamCity On-Premises найдена post-authentication уязвимость высокой важности CVE-2026-44413, позволяющая любому аутентифицированному пользователю (включая guest, если он включён) экспонировать части серверного API неавторизованным пользователям. Уязвимость затрагивает все версии On-Premises до 2025.11.4 включительно; исправлена в 2026.1; TeamCity Cloud не затронут. Уязвимость была раскрыта по координированной программе 30 апреля 2026 года исследователем Martin Orem (binary.house). Для тех, кто не может сразу обновиться, выпущен патч-плагин для версий 2017.1+; в 2024.03+ он скачивается автоматически и применяется через Administration → Updates → Available security updates. Если TeamCity-сервер публично доступен и патч пока не применён — рекомендуется ограничить внешний доступ. Технически уязвимость касается установок, где firewall пропускает входящие соединения на нестандартных портах или где build-агенты крутятся на одном хосте с сервером.

# Минимальные шаги для администратора TeamCity On-Premises
# 1) Проверка версии текущего сервера
curl -s https://teamcity.example.com/app/rest/server | grep -oE 'version="[^"]+"'

# 2) Загрузка дистрибутива 2026.1 или установка патч-плагина из веба админки
#    Administration → Updates → Available security updates → Apply
#    (TeamCity 2024.03+ обнаружит и предложит автоматически)

# 3) До применения патча: ограничить внешний доступ через nginx/firewall
#    например, iptables на узле TeamCity
sudo iptables -I INPUT -p tcp --dport 8111 -s 10.0.0.0/8 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 8111 -j DROP

Значимость

Стандартное по форме security-объявление с двумя митигациями (обновление до 2026.1 или установка патч-плагина), но содержательно полезное: TeamCity On-Premises широко применяется в корпоративном CI/CD, и публично доступный сервер с guest-доступом без патча — реальная цель для разведки. Лучшие практики — VPN-доступ, ограничение портов и разнесение TeamCity-сервера и build-агентов по разным хостам — даны прямо в посте.

🧾 Транскрипт (формат)

High-Severity Security Issue Affecting TeamCity On-Premises (CVE-2026-44413) – Update to 2026.1 Now Source: https://blog.jetbrains.com/teamcity/2026/05/cve-2026-44413/

Summary A high-severity post-authentication security vulnerability has been identified in TeamCity On-Premises and assigned the CVE identifier CVE-2026-44413. It may allow any authenticated user to expose some parts of the TeamCity server API to unauthorized users. It affects all TeamCity On-Premises versions through 2025.11.4. The issue has been fixed in version 2026.1. We encourage all users to update their servers to the latest version. For those who are unable to do so, we have released a security patch plugin. TeamCity Cloud is not affected and requires no action. Details A high-severity post-authentication security vulnerability has been identified in TeamCity On-Premises. If exploited, this flaw may allow any authenticated user to expose some parts of the TeamCity server API to unauthorized users.

All versions of TeamCity On-Premises are affected, while TeamCity Cloud is not affected and requires no action. We have verified that TeamCity Cloud environments were not impacted by this issue.

This post-authentication privilege escalation vulnerability was reported to us privately on April 30, 2026, by Martin Orem (binary.house) in accordance with our coordinated disclosure policy. It has been assigned the Common Vulnerabilities and Exposures (CVE) identifier CVE-2026-44413.

A fix for the issue has been introduced in version 2026.1. We have also released a security patch plugin for 2017.1+ so that customers who are unable to upgrade can still patch their environments.

If your TeamCity server is publicly accessible over the internet and you are unable to apply one of the mitigation options described below, we strongly recommend temporarily restricting external access until you have done so.

Mitigation option 1: Update your server to 2026.1 To update your TeamCity server, download and install the latest version (2026.1) or use the automatic update option within TeamCity. This version includes a fix for the vulnerability described above.

Mitigation option 2: Apply the security patch plugin If you are unable to update your server to version 2026.1, we have also released a security patch plugin that can be installed on TeamCity 2017.1+ and will patch the specific vulnerability described above.

You can acquire it in the following ways:

Download and install it manually. For TeamCity 2024.03 and newer, TeamCity automatically downloads available security patch plugins and notifies administrators (if notifications are configured). You can review and apply pending security patches from Administration | Updates, under Available security updates.

For TeamCity 2017.1 to 2018.1, a server restart is required after the plugin is installed. Starting from TeamCity 2018.2, you can enable it without restarting the TeamCity server.

See the TeamCity plugin installation instructions for more information.

Important: The security patch plugin will only address the vulnerability described above. We always recommend upgrading your server to the latest version to benefit from many other security updates.

Best practices As a longer-term security best practice for internet-facing TeamCity servers (that is, servers accessible to external users who can reach the TeamCity login screen), consider requiring connections through a VPN or implementing an additional security layer to help prevent unauthorized access. Even exposing the TeamCity login screen or REST API can provide potential entry points for attackers to exploit newly disclosed vulnerabilities.

Technical details This vulnerability affects all TeamCity installations where the firewall permits inbound connections on ports other than the standard HTTP/HTTPS one used by TeamCity, or where build agents are running on the same host as the TeamCity server.

Exploitation of this vulnerability requires access to a TeamCity account, including a standard user account or the guest user account (if guest access is enabled). If exploited, it could allow an authenticated user to expose some parts of the TeamCity server API to unauthorized access.

As a general best practice, we strongly recommend restricting inbound network access to only required ports.

TeamCity servers should also run on dedicated hosts separate from build agents, as described in our documentation.

Support If you have any questions regarding this issue or encounter problems upgrading, please get in touch with the TeamCity Support team by submitting a ticket.