CVE-2026-49372: JetBrains TeamCity SSRF Vulnerability

CVE-2026-49372 Overview

CVE-2026-49372 is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability in JetBrains TeamCity. The flaw resides in the build status functionality and allows remote attackers to issue arbitrary requests from the TeamCity server without authentication. JetBrains addressed the issue in TeamCity 2026.1 and 2025.11.5. The vulnerability is tracked under CWE-918 and carries a network-based attack vector with no privileges or user interaction required.

Critical Impact
Unauthenticated attackers can coerce the TeamCity server to send crafted HTTP requests to internal systems, exposing internal services, cloud metadata endpoints, and other resources reachable from the CI/CD server.

Affected Products

JetBrains TeamCity versions prior to 2026.1
JetBrains TeamCity versions prior to 2025.11.5
On-premises TeamCity build servers exposed to untrusted networks

Discovery Timeline

2026-05-29 - CVE-2026-49372 published to NVD
2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-49372

Vulnerability Analysis

The vulnerability is a Server-Side Request Forgery (SSRF) reachable through the build status endpoint in JetBrains TeamCity. The endpoint accepts a user-supplied parameter that is incorporated into a server-initiated HTTP request without sufficient validation of the destination. Because the request originates from the TeamCity server, attackers can target hosts and ports that are not directly reachable from the public internet.

The build status feature is reachable without authentication, which broadens the attack surface significantly. An external attacker only needs network access to the TeamCity web interface to trigger outbound requests from the server. The flaw affects confidentiality, since responses or response-derived behavior may expose information about internal infrastructure.

Root Cause

The root cause is insufficient validation of a URL or host parameter used by the build status component. The component fetches or interacts with a resource based on attacker-controlled input. The application does not enforce an allowlist of permitted destinations and does not block requests to internal address ranges, cloud metadata services, or loopback interfaces.

Attack Vector

An unauthenticated attacker sends a crafted HTTP request to the TeamCity build status endpoint, supplying a target URL of their choosing. The TeamCity server resolves the host and issues an outbound request. Typical targets include internal HTTP services, administrative interfaces bound to localhost, and cloud instance metadata endpoints such as 169.254.169.254. Behavioral differences in response timing, status codes, or returned content can be used to enumerate internal hosts and services.

No public proof-of-concept code is available at the time of writing. Refer to the JetBrains Security Issues Fixed advisory for vendor guidance.

Detection Methods for CVE-2026-49372

Indicators of Compromise

Outbound HTTP requests from the TeamCity server process to internal RFC1918 addresses, 127.0.0.1, or cloud metadata IPs such as 169.254.169.254.
Unauthenticated requests to build status URLs containing URL-encoded host parameters or unusual query strings.
Spikes in DNS lookups originating from the TeamCity host for external or unexpected domains.

Detection Strategies

Inspect TeamCity access logs for unauthenticated requests to build status endpoints with abnormal URL or host parameters.
Correlate web access logs with outbound proxy or firewall logs to identify server-initiated requests that follow inbound build status calls.
Alert on any process belonging to the TeamCity JVM making connections to link-local or metadata IP ranges.

Monitoring Recommendations

Enable egress logging on the TeamCity host and forward logs to a centralized analytics platform for retention and review.
Monitor for new outbound connections to internal management interfaces from the CI/CD server segment.
Track TeamCity version strings in asset inventory to identify unpatched instances quickly.

How to Mitigate CVE-2026-49372

Immediate Actions Required

Upgrade TeamCity to version 2026.1 or 2025.11.5 or later without delay.
Restrict network access to the TeamCity web interface using firewalls or reverse proxies until patching is complete.
Block egress from the TeamCity server to cloud metadata endpoints and internal management networks that the CI/CD platform does not require.

Patch Information

JetBrains has released fixed versions 2026.1 and 2025.11.5 that address the SSRF in the build status component. Patch details are documented in the JetBrains Security Issues Fixed advisory. Administrators should review the release notes and apply the upgrade through standard TeamCity update procedures.

Workarounds

Place TeamCity behind an authenticating reverse proxy that blocks unauthenticated access to build status endpoints.
Apply strict egress filtering on the TeamCity host to deny outbound requests to RFC1918 ranges, loopback, and 169.254.169.254.
Disable or restrict public exposure of the TeamCity web interface until the patched version is deployed.

bash

# Example iptables egress restriction for the TeamCity host
iptables -A OUTPUT -d 169.254.169.254 -j DROP
iptables -A OUTPUT -d 127.0.0.0/8 ! -o lo -j DROP
iptables -A OUTPUT -d 10.0.0.0/8 -m owner --uid-owner teamcity -j DROP
iptables -A OUTPUT -d 172.16.0.0/12 -m owner --uid-owner teamcity -j DROP
iptables -A OUTPUT -d 192.168.0.0/16 -m owner --uid-owner teamcity -j DROP