CVE-2026-49373: JetBrains TeamCity RCE Vulnerability

CVE-2026-49373 Overview

CVE-2026-49373 is a remote code execution vulnerability in JetBrains TeamCity versions prior to 2026.1. The flaw resides in the handling of Perforce connection settings, where authenticated users can supply crafted input that leads to command execution on the build server. JetBrains TeamCity is a widely deployed continuous integration and continuous delivery (CI/CD) platform, making compromise of a TeamCity instance a high-value target for attackers seeking lateral movement into source code, build artifacts, and downstream production systems. The vulnerability is classified under [CWE-88] Improper Neutralization of Argument Delimiters in a Command (Argument Injection).

Critical Impact

An authenticated attacker can achieve remote code execution on the TeamCity server through manipulated Perforce version control connection parameters, compromising build pipelines and accessible secrets.

Affected Products

• JetBrains TeamCity versions prior to 2026.1
• TeamCity instances configured with Perforce version control system (VCS) integration
• Self-hosted TeamCity deployments exposing project administration to authenticated users

Discovery Timeline

• 2026-05-29 - CVE-2026-49373 published to the National Vulnerability Database (NVD)
• 2026-06-02 - Last updated in NVD database

Technical Details for CVE-2026-49373

Vulnerability Analysis

The vulnerability exists in the Perforce VCS root configuration handling within JetBrains TeamCity. When a user configures or modifies a Perforce connection, TeamCity passes user-controlled connection parameters to the underlying Perforce command-line client. Insufficient neutralization of argument delimiters allows an attacker to inject additional command-line arguments that the Perforce client interprets, leading to execution of attacker-controlled code on the TeamCity host.

Exploitation requires authenticated access with privileges sufficient to create or edit a VCS root. Once exploited, the attacker gains code execution in the context of the TeamCity server process, which typically holds credentials, deployment keys, and access to internal build infrastructure. The Perforce connection test or VCS polling routine triggers the injected payload, so no human interaction beyond initial submission is required.

Root Cause

The root cause is argument injection [CWE-88] in the construction of the Perforce client invocation. TeamCity assembles command arguments from user-controlled fields in the Perforce connection settings without enforcing strict allowlists or escaping for argument delimiters. Attackers can supply values containing flag-like tokens that the Perforce binary parses as options, including options that load arbitrary configuration or execute commands.

Attack Vector

The attack vector is network-based and requires low-privilege authentication to the TeamCity web interface. An attacker with project administrator or VCS configuration rights creates or modifies a Perforce VCS root, embeds a malicious argument in a connection field, and triggers a connection test or waits for the polling cycle. Because TeamCity build agents and the server often run with elevated privileges and store credentials, successful exploitation typically yields full pipeline compromise. See the JetBrains Security Issues Fixed advisory for vendor details.

Detection Methods for CVE-2026-49373

Indicators of Compromise

• Unexpected child processes spawned by the TeamCity server JVM, particularly shells or interpreters launched from the Perforce client (p4) process tree
• Newly created or modified Perforce VCS roots containing unusual characters, leading dashes, or flag-like tokens in connection fields
• Outbound network connections from the TeamCity server to unfamiliar hosts shortly after VCS configuration changes
• Audit log entries showing VCS root creation or edit operations followed by failed or anomalous connection tests

Detection Strategies

• Monitor TeamCity audit logs for VCS root modifications and correlate with subsequent process creation events on the server host
• Alert on p4 or p4d processes spawning child processes such as cmd.exe, powershell.exe, /bin/sh, or bash
• Inspect TeamCity configuration backups and config/projects/ directories for Perforce settings containing suspicious argument patterns

Monitoring Recommendations

• Enable verbose audit logging on the TeamCity server and forward events to a centralized logging platform for retention and analysis
• Track process lineage on TeamCity hosts using endpoint detection and response (EDR) telemetry to surface anomalous command execution
• Review accounts holding project administrator or VCS configuration privileges and monitor authentication events for those accounts

How to Mitigate CVE-2026-49373

Immediate Actions Required

• Upgrade JetBrains TeamCity to version 2026.1 or later, which contains the official fix
• Audit all existing Perforce VCS roots for suspicious values in connection parameters and remove any unauthorized configurations
• Rotate credentials, tokens, and SSH keys stored within TeamCity if the server may have been exposed prior to patching
• Restrict project administrator and VCS editing permissions to a minimal set of trusted users

Patch Information

JetBrains has resolved CVE-2026-49373 in TeamCity 2026.1. Administrators should follow the standard TeamCity upgrade procedure and validate the build server starts cleanly after the upgrade. Refer to the JetBrains Security Issues Fixed page for the authoritative advisory and release notes.

Workarounds

• Temporarily revoke VCS root creation and editing permissions from non-essential users until the patch is applied
• Disable Perforce VCS integrations on TeamCity instances that do not require them
• Place the TeamCity web interface behind a VPN or restricted network segment to limit authenticated attack surface

# Verify TeamCity version and review Perforce VCS roots
cat /opt/TeamCity/webapps/ROOT/WEB-INF/classes/META-INF/MANIFEST.MF | grep -i version
grep -r "type=\"perforce\"" /data/teamcity_server/config/projects/