Medium WID-SEC-2026-1758 11 CVEs

JetBrains TeamCity: Mehrere Schwachstellen

Published May 31, 2026 · Updated May 31, 2026 · de-DE

Vendor: JetBrains Product: TeamCity Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in JetBrains TeamCity ausnutzen, um Informationen offenzulegen, um einen Cross-Site Scripting Angriff durchzuführen, um Sicherheitsvorkehrungen zu umgehen, und um beliebigen Programmcode auszuführen.

Product

TeamCity ist ein Continuous Integration und Deployment Tool für Entwickler und DevOps Ingenieure.

Vulnerabilities 11

High 7.6

CVE-2026-49374

In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters

JetBrains TeamCity

May 29, 2026
High 7.5

CVE-2026-49372

In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible

JetBrains TeamCity

May 29, 2026
High 7.1

CVE-2026-49371

In JetBrains TeamCity before 2026.1.1 reflected XSS in the keyword filter was possible

JetBrains TeamCity

May 29, 2026
High 7.1

CVE-2026-49373 EPSS 33%

In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings

JetBrains TeamCity

May 29, 2026
Medium 6.5

CVE-2026-49376

In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML plugin

JetBrains TeamCity

May 29, 2026
Medium 6.5

CVE-2026-49379

In JetBrains TeamCity before 2026.1 credentials could be exposed in thread names

JetBrains TeamCity

May 29, 2026
Medium 6.1

CVE-2026-49375

In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download page

JetBrains TeamCity

May 29, 2026
Medium 4.3

CVE-2026-49377

In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters

JetBrains TeamCity

May 29, 2026
Medium 4.3

CVE-2026-49378

In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion

JetBrains TeamCity

May 29, 2026
Low 3.4

CVE-2026-49381

In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possible

JetBrains TeamCity

May 29, 2026
Low 3.1

CVE-2026-49380

In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possible

JetBrains TeamCity

May 29, 2026

Revision history

2026-05-31 #1
Initiale Fassung

References

Fixed security issues vom 2026-05-31
https://www.jetbrains.com/privacy-security/issues-fixed/
EU Vulnerability Database vom 2026-05-31
https://euvd.enisa.europa.eu/enisa/EUVD-2026-33389
EU Vulnerability Database vom 2026-05-31
https://euvd.enisa.europa.eu/enisa/EUVD-2026-33380
EU Vulnerability Database vom 2026-05-31
https://euvd.enisa.europa.eu/enisa/EUVD-2026-33381
EU Vulnerability Database vom 2026-05-31
https://euvd.enisa.europa.eu/enisa/EUVD-2026-33382
EU Vulnerability Database vom 2026-05-31
https://euvd.enisa.europa.eu/enisa/EUVD-2026-33383
EU Vulnerability Database vom 2026-05-31
https://euvd.enisa.europa.eu/enisa/EUVD-2026-33384
EU Vulnerability Database vom 2026-05-31
https://euvd.enisa.europa.eu/enisa/EUVD-2026-33385
EU Vulnerability Database vom 2026-05-31
https://euvd.enisa.europa.eu/enisa/EUVD-2026-33386
EU Vulnerability Database vom 2026-05-31
https://euvd.enisa.europa.eu/enisa/EUVD-2026-33387
EU Vulnerability Database vom 2026-05-31
https://euvd.enisa.europa.eu/enisa/EUVD-2026-33388
EU Vulnerability Database vom 2026-05-31
https://euvd.enisa.europa.eu/enisa/EUVD-2026-33389