CVE-2026-49371: In JetBrains TeamCity before 2026

Synopsis

Reflected cross-site scripting (XSS) in JetBrains TeamCity lets an attacker inject script into the keyword filter parameter that executes in a victim's browser when they follow a crafted link. The flaw is reachable over the network without authentication, but a logged-in user must click the attacker's URL for the payload to run, after which the attacker can read sensitive page content and perform limited actions in the victim's session. A patched-image rebuild at 2026.1.1 is available on HarborGuard for affected environments.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must be able to reach the TeamCity web interface over the network for the victim to load the crafted URL.

• AuthenticationNot required

  No attacker credentials are needed to craft or deliver the malicious link.

• Victim interactionRequired

  A TeamCity user must click an attacker-supplied link containing the malicious keyword filter payload.

• Attack complexityDetail

  Attack complexity is low; the reflected XSS fires reliably once the victim loads the crafted URL.

Blast Radius

• Executes attacker-controlled JavaScript in the victim's authenticated TeamCity session.
• Reads page content visible to the victim, including build configuration and project data shown in the UI.
• Performs limited write actions in the victim's session within the same-origin context of the TeamCity interface.