JetBrains TeamCity: OS command injection in Pipeline Git connection settings
Summary
TeamCity versions before 2026.2, 2026.1.4 and 2025.11.8 contain a flaw in the Pipeline Git connection settings that allows command execution on Windows servers. An authenticated user with a valid TeamCity account can inject CRLF characters into these settings to run commands on the server. NVD rates this 8.8 (High), with high impact on confidentiality, integrity and availability.
Affected
- JetBrains TeamCity before 2026.2
- JetBrains TeamCity before 2026.1.4
- JetBrains TeamCity before 2025.11.8
- Platform: Windows only
Fixed in
- Upgrade to 2025.11.8, 2026.1.4 or 2026.2 or later
Workaround
- Restrict who can modify Pipeline Git connection settings to trusted administrators (advice from the OpenCVE page, not confirmed by JetBrains)
- For internet-facing servers, require access through a VPN or an additional security layer (general JetBrains guidance)
Exploitation
- Not listed in CISA KEV
- CISA SSVC data: exploitation none, automatable no
- Public proof of concept: none found; treat as unknown
Our recommendation
- Confirm the installed TeamCity version and upgrade to a fixed release
- Check the JetBrains advisory page directly, as its entry for this CVE could not be verified
- Limit rights to edit Git connection settings to trusted administrators
- Keep the TeamCity web interface off the public internet (VPN or allow-list)
- Review CVE-2026-63077 (critical, unauthenticated RCE), fixed in 2025.11.7 and 2026.1.3, with higher priority
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- JetBrains fixed security issues www.jetbrains.com
- OpenCVE CVE-2026-100254 app.opencve.io
- VulDB entry 412149 vuldb.com
- Nessus plugin notes for TeamCity 2026.2, 2026.1.4, 2025.11.8 vulners.com
- JetBrains blog: CVE-2026-44413 guidance blog.jetbrains.com
- Tenable Nessus plugin 362481 www.tenable.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 23:06.
Original description (NVD)
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 authenticated users could execute commands on Windows servers via CRLF injection in Pipeline Git connection settings
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.