CVE-2026-49377
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
In JetBrains TeamCity before 2025.11.2, sensitive data is exposed via default agent parameters.
Risk Assessment
Sensitive data could be disclosed to unauthorized parties, compromising CI/CD system confidentiality.
Recommendation
Update JetBrains TeamCity to version 2025.11.2 or later.
Other vulnerabilities in JetBrains TeamCity
See all- CVE-2026-63077CriticalActively exploited
In JetBrains TeamCity before versions 2026.1.3 and 2025.11.7, unauthenticated remote code execution is possible via the agent polling protocol.
- CVE-2026-65907Critical
In JetBrains TeamCity before 2026.1.2 and 2025.11.6, code execution in Git VCS roots was possible.
- CVE-2024-27198CriticalActively exploited
In JetBrains TeamCity before 2023.11.4, an authentication bypass vulnerability exists that allows performing admin actions without authorization.
- CVE-2023-42793CriticalActively exploited
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible.
- CVE-2023-41249Medium
In JetBrains TeamCity versions before 2023.05.3, reflected XSS was possible during copying Build Step.
- CVE-2023-34225Medium
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the NuGet feed page.
- CVE-2023-34220Medium
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the Commit Status Publisher window.
- CVE-2023-34218Critical
In JetBrains TeamCity before version 2023.05, it was possible to bypass permission checks, allowing for the execution of admin actions.
- CVE-2026-111096Medium
In JetBrains TeamCity before 2026.2, 2026.1.4, and 2025.11.8, stored XSS in the classic build log was possible. Malicious content stored in the log can execute in the browser of a user viewing the log.
- CVE-2026-111095High
JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8 contains a stored XSS vulnerability in the classic project overview. This may allow script execution in a user's browser.
Original NVD description (English source)
In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parameters
Vulnerability data from NVD (NIST) · CISA KEV · EPSS