JetBrains TeamCity: Sandbox escape in Kotlin DSL allows code execution on server
Summary
JetBrains TeamCity before 2026.1.3 and 2025.11.7 contains a sandbox escape in its Kotlin DSL, classified as CWE-184. According to the official CVE record, a user who can submit or modify Kotlin DSL content may be able to execute code on the TeamCity server. Third-party sources list a lower CVSS score (8.8) that requires low privileges, so the actual prerequisites must be verified against NVD and the JetBrains advisory.
Affected
- JetBrains TeamCity before 2026.1.3
- JetBrains TeamCity before 2025.11.7
- Whether the 2026.2.x branch is affected: Unknown.
Fixed in
- TeamCity 2026.1.3
- TeamCity 2025.11.7
Workaround
- No vendor mitigation known.
- Interim measure: limit the accounts that can create or approve Kotlin DSL configuration and review recent DSL changes for unexpected code (from a secondary source, not JetBrains).
Exploitation
- No confirmed exploitation in the wild known.
- No public proof-of-concept found in the sources; search coverage was limited.
- Not related to CVE-2026-63077, a separate and actively exploited TeamCity flaw.
Our recommendation
- Inventory all TeamCity servers and their versions and check whether any are reachable from the internet.
- Update to 2026.1.3 or 2025.11.7 after confirming the fixed builds in the JetBrains advisory.
- Restrict who can edit Kotlin DSL content and review version control history for unexpected changes.
- Monitor for configuration changes made outside version control and for unexpected child processes of the TeamCity server.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- JetBrains: Fixed security issues www.jetbrains.com
- Vulners: VulnRichment record CVE-2026-106218 vulners.com
- Strix: CVE-2026-106218 www.strix.ai
- dev.to: TeamCity Kotlin DSL sandbox escape (analysis) dev.to
- dev.to: Detecting and hunting CVE-2026-106218 exploitation dev.to
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:35.
Original description (NVD)
In JetBrains TeamCity before 2026.1.3 2025.11.7 kotlin DSL sandbox escape leading to RCE on the server was possible
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.