CVE-2026-106219: JetBrains TeamCity Information Disclosure

CVE-2026-106219 Overview

CVE-2026-106219 is an information disclosure vulnerability in JetBrains TeamCity versions prior to 2026.2.1. The flaw stems from missing validation of Git submodule URLs, which allows an authenticated attacker to read local repositories on the TeamCity server. The weakness is classified under CWE-73: External Control of File Name or Path. JetBrains addressed the issue in TeamCity 2026.2.1.

Critical Impact
Authenticated users can abuse crafted Git submodule URLs to read arbitrary local repositories hosted on the TeamCity server, exposing source code and project data.

Affected Products

JetBrains TeamCity versions before 2026.2.1
On-premises TeamCity server installations exposing Git-based VCS roots
Project configurations that permit user-controlled Git submodule definitions

Discovery Timeline

2026-10-06 - CVE-2026-106219 published to NVD
2026-10-06 - Last updated in NVD database

Technical Details for CVE-2026-106219

Vulnerability Analysis

TeamCity processes Git submodules declared in .gitmodules files during repository checkout operations. The server failed to validate the URLs declared for those submodules before attempting to resolve them. An authenticated user with permissions to configure or trigger a VCS root could point a submodule at a local path on the TeamCity server. The server then read that path as if it were a legitimate Git repository and exposed its contents to the project context.

The root issue is a path and resource reference validation failure, aligning with [CWE-73]. The vulnerability affects confidentiality only. Integrity and availability remain intact based on the CVSS vector published by JetBrains.

Root Cause

The Git submodule handler did not restrict URL schemes or filesystem locations before dereferencing them. Attacker-supplied submodule URLs could reference local filesystem paths or on-server repositories outside the project's authorized scope. Without allowlisting remote schemes or sandboxing local reads, the checkout process trusted the submodule declaration as provided.

Attack Vector

Exploitation requires network access to the TeamCity web interface and a valid account with permission to edit a build configuration or supply a repository containing a crafted .gitmodules file. The attacker commits a submodule entry pointing to a local repository path on the TeamCity server. When TeamCity performs the checkout, it reads the targeted repository and makes its contents accessible to the attacker's build context. No user interaction is required beyond the standard build trigger.

No public proof-of-concept exploit is listed in the referenced advisory. Review the JetBrains Security Issues Fixed page for vendor-published technical context.

Detection Methods for CVE-2026-106219

Indicators of Compromise

.gitmodules files in project repositories that reference local filesystem paths, file:// URLs, or on-server repository locations
Build logs showing submodule resolution against paths outside the expected remote Git host
Unexpected read access from the TeamCity service account to repositories belonging to other projects

Detection Strategies

Audit all project repositories for .gitmodules entries and flag any submodule URL that is not an approved remote origin
Correlate TeamCity audit logs with filesystem access events on the server to identify cross-project repository reads
Review recent build configuration changes made by non-administrative users for suspicious VCS root additions

Monitoring Recommendations

Enable TeamCity audit logging and forward events to a centralized SIEM for retention and correlation
Monitor the TeamCity server filesystem for reads of repository directories by builds that do not own them
Alert on new or modified .gitmodules files committed to repositories integrated with TeamCity

How to Mitigate CVE-2026-106219

Immediate Actions Required

Upgrade all TeamCity server instances to version 2026.2.1 or later
Review user permissions and remove project configuration rights from accounts that do not require them
Inspect existing projects for .gitmodules entries referencing local or unexpected paths and remove them

Patch Information

JetBrains fixed CVE-2026-106219 in TeamCity 2026.2.1. Refer to the JetBrains Security Issues Fixed advisory page for the authoritative patch notice and upgrade guidance.

Workarounds

Restrict VCS root creation and editing to trusted administrators until the upgrade is applied
Disable automatic submodule checkout in project VCS root settings where submodules are not required
Isolate the TeamCity server filesystem so that only the active project's repositories are readable by the service account

bash

# Verify installed TeamCity version and plan upgrade to 2026.2.1 or later
cat /opt/TeamCity/webapps/ROOT/WEB-INF/classes/buildServerResources/version.properties

# Audit repositories for suspicious submodule declarations
grep -R --include=.gitmodules -nE 'url\s*=\s*(file://|/|\.\./)' /path/to/repos