CVE-2025-26492 Overview
CVE-2025-26492 affects JetBrains TeamCity continuous integration server versions before 2024.12.2. The flaw stems from improper Kubernetes connection settings that could expose sensitive resources to unauthorized parties. JetBrains classifies the issue under credentials handling weaknesses, tracked as CWE-522: Insufficiently Protected Credentials. The vulnerability is network-exploitable, requires no authentication, and impacts both confidentiality and integrity of connected Kubernetes environments.
Critical Impact
Unauthenticated network attackers can access sensitive Kubernetes resources configured through TeamCity, potentially exposing cluster credentials, workloads, and CI/CD pipeline secrets.
Affected Products
- JetBrains TeamCity versions prior to 2024.12.2
- TeamCity build configurations using Kubernetes connection features
- CI/CD pipelines integrating with Kubernetes clusters through TeamCity
Discovery Timeline
- 2025-02-11 - CVE-2025-26492 published to NVD
- 2025-05-16 - Last updated in NVD database
Technical Details for CVE-2025-26492
Vulnerability Analysis
The vulnerability resides in the Kubernetes connection handling logic of JetBrains TeamCity. TeamCity supports Kubernetes connections to provision build agents and deploy artifacts to clusters. These connections store authentication material such as service account tokens, kubeconfig files, and API server endpoints.
Improper configuration handling allows the Kubernetes connection settings to expose sensitive resources beyond their intended scope. Attackers reaching the TeamCity instance over the network can leverage this exposure without prior authentication or user interaction. The flaw is classified under [CWE-522], indicating credentials are not adequately protected in storage or transit within the application.
Root Cause
The root cause is insufficient access control around Kubernetes connection settings inside TeamCity projects. Connection metadata and associated secrets become reachable through the affected endpoints rather than being restricted to authorized project administrators. JetBrains addressed the issue in TeamCity 2024.12.2.
Attack Vector
The attack vector is network-based and requires no privileges. An attacker who can reach a vulnerable TeamCity server queries the exposed Kubernetes connection surface to extract cluster details. Recovered credentials enable lateral movement into the Kubernetes API, where the attacker can read secrets, deploy malicious workloads, or pivot to downstream production systems.
No public proof-of-concept code has been released. The vulnerability is described in prose only within the JetBrains Security Issues Fixed advisory.
Detection Methods for CVE-2025-26492
Indicators of Compromise
- Unexpected authentication events against the Kubernetes API from TeamCity service accounts outside scheduled build windows.
- New or modified Deployment, Pod, or ServiceAccount objects created using TeamCity-managed credentials.
- Outbound network connections from TeamCity servers to Kubernetes endpoints that do not correspond to defined build configurations.
Detection Strategies
- Audit all TeamCity projects for configured Kubernetes connections and verify which user roles can view them.
- Review TeamCity server access logs for anonymous or low-privilege requests touching project settings and connection endpoints.
- Correlate Kubernetes audit logs with TeamCity build history to identify API calls that lack a corresponding pipeline execution.
Monitoring Recommendations
- Enable Kubernetes API server audit logging at the Metadata level or higher and forward events to a centralized SIEM.
- Monitor TeamCity administrator and project configuration changes, especially edits to Kubernetes connection objects.
- Alert on the use of long-lived Kubernetes service account tokens originating from CI/CD infrastructure.
How to Mitigate CVE-2025-26492
Immediate Actions Required
- Upgrade JetBrains TeamCity to version 2024.12.2 or later on all server instances.
- Rotate every Kubernetes service account token, kubeconfig, and certificate stored in TeamCity connections after upgrading.
- Restrict network access to the TeamCity web interface using firewall rules or a reverse proxy with authentication.
- Review Kubernetes RBAC bindings used by TeamCity and enforce least privilege on the affected service accounts.
Patch Information
JetBrains released the fix in TeamCity 2024.12.2. Details are listed on the JetBrains Security Issues Fixed page. Administrators running on-premises TeamCity should follow the standard upgrade procedure and validate that all build agents reconnect after the update. TeamCity Cloud customers receive the patch automatically.
Workarounds
- If immediate upgrade is not possible, disable Kubernetes connections in TeamCity projects until the patch is applied.
- Place the TeamCity server behind a VPN or zero-trust gateway to remove unauthenticated network exposure.
- Scope Kubernetes service accounts to a dedicated namespace with no access to cluster-wide secrets.
# Verify the running TeamCity version after upgrade
curl -s https://teamcity.example.com/app/rest/server | grep -i version
# Rotate a Kubernetes service account token used by TeamCity
kubectl -n ci delete secret teamcity-agent-token
kubectl -n ci create token teamcity-agent --duration=24h
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
