CVE-2026-59796
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
In JetBrains TeamCity before version 2026.1.2, a vulnerability was found that allows pipeline modification due to improper permission checks.
Risk Assessment
An attacker can unauthorizedly modify CI/CD pipeline configurations, potentially leading to malicious code injection, data theft, or disruption of build and deployment processes.
Recommendation
Immediately update JetBrains TeamCity to version 2026.1.2 or later, which includes a fix for this vulnerability.
Other vulnerabilities in JetBrains TeamCity
See all- CVE-2026-63077CriticalActively exploited
In JetBrains TeamCity before versions 2026.1.3 and 2025.11.7, unauthenticated remote code execution is possible via the agent polling protocol.
- CVE-2026-65907Critical
In JetBrains TeamCity before 2026.1.2 and 2025.11.6, code execution in Git VCS roots was possible.
- CVE-2024-27198CriticalActively exploited
In JetBrains TeamCity before 2023.11.4, an authentication bypass vulnerability exists that allows performing admin actions without authorization.
- CVE-2023-42793CriticalActively exploited
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible.
- CVE-2023-41249Medium
In JetBrains TeamCity versions before 2023.05.3, reflected XSS was possible during copying Build Step.
- CVE-2023-34225Medium
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the NuGet feed page.
- CVE-2023-34220Medium
In JetBrains TeamCity versions before 2023.05, a stored XSS vulnerability was present in the Commit Status Publisher window.
- CVE-2023-34218Critical
In JetBrains TeamCity before version 2023.05, it was possible to bypass permission checks, allowing for the execution of admin actions.
- CVE-2026-111096Medium
In JetBrains TeamCity before 2026.2, 2026.1.4, and 2025.11.8, stored XSS in the classic build log was possible. Malicious content stored in the log can execute in the browser of a user viewing the log.
- CVE-2026-111095High
JetBrains TeamCity before versions 2026.2, 2026.1.4, and 2025.11.8 contains a stored XSS vulnerability in the classic project overview. This may allow script execution in a user's browser.
Original NVD description (English source)
In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks
Vulnerability data from NVD (NIST) · CISA KEV · EPSS