HarborGuard / CVE
Back to search
HIGHCVE-2026-49373Published Modified CNA JetBrains

CVE-2026-49373: In JetBrains TeamCity before 2026

In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settings

HarborGuard Analysis

HarborGuard analysis

Synopsis

This is a remote code execution flaw in JetBrains TeamCity reachable through Perforce connection settings. An attacker with a low-privilege TeamCity account can reach the vulnerable configuration over the network and execute code, with high impact on confidentiality and limited impact on integrity. A patched-image rebuild at version 2026.1 is available on HarborGuard for affected environments.

HarborGuard Coverage

Detection

Detection is available across every HarborGuard environment: the CVE is ingested from upstream feeds within minutes of publication and matched against TeamCity images in customer registries and CI pipelines, including custom-built images derived from JetBrains base layers.

Available
Triage

Triage is available with the published CVSS v3.1 score of 7.1 (high) weighted against each customer org's compliance policy, then routed to the appropriate inbox so the right team sees it without manual triage.

Available
Patch

A patched-image rebuild at TeamCity 2026.1 is available on HarborGuard for environments running an affected version. Customers who opt into auto-remediation get the rebuild, a regression-test run, and a PR opened against affected workloads automatically.

Available

Exploit Conditions

  • Network reachabilityRequired

    The attacker must reach the TeamCity server over the network to interact with Perforce connection settings.

  • AuthenticationRequired

    A low-privilege TeamCity account with access to configure or edit Perforce connection settings is sufficient.

  • Victim interactionNot required

    No user or administrator action is needed for exploitation.

  • Attack complexityDetail

    Attack complexity is low: the exploit is reliable and does not depend on environmental conditions.

Blast Radius

  • Executes arbitrary code in the context of the TeamCity server process, exposing source code, build artifacts, and stored credentials.
  • Reads sensitive build configuration and secrets that the TeamCity server has access to, including VCS tokens and deployment keys.
  • Allows limited modification of data the TeamCity process can write, such as build settings or artifact storage.

How HarborGuard Handles This

Available on HarborGuard: a rebuilt TeamCity image at 2026.1 is published as soon as the fix version is ingested, and environments with auto-remediation enabled receive the rebuild, a regression-test run, and a PR opened against affected workloads. Median time from CVE publication to merged patch PR for high-severity issues is around 90 minutes for auto-remediation environments; other environments see the patched image and an advisory in their triage inbox on the same ingest cycle, with restricting Perforce VCS configuration privileges to trusted users as a reasonable interim control.

See how HarborGuard automates this

Metrics

CVSS v3.1
7.1
Severity
HIGH
Fixed in
2026.1
Affected Products
1

Fix available

2026.1
Affected packages
  • JetBrains / TeamCity
    < 2026.1 (from 0)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N
References