CVE-2026-59794: JetBrains TeamCity XSS Vulnerability

CVE-2026-59794 Overview

CVE-2026-59794 is a stored cross-site scripting (XSS) vulnerability affecting JetBrains TeamCity versions before 2026.1.2. The flaw resides on the cloud profile page, where agent-reported data is rendered without sufficient output encoding. An authenticated attacker with agent-level privileges can inject persistent JavaScript payloads that execute in the browsers of TeamCity users who view the affected page. The issue is tracked under CWE-79 and requires user interaction to trigger.

Critical Impact
Persistent script execution in the context of TeamCity administrators viewing cloud profile pages, enabling session compromise, CI/CD pipeline tampering, and lateral movement into build infrastructure.

Affected Products

JetBrains TeamCity versions prior to 2026.1.2
On-premises TeamCity servers using cloud agent profiles
TeamCity deployments integrating cloud build agents (AWS, Azure, GCP, Kubernetes)

Discovery Timeline

2026-07-10 - CVE-2026-59794 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-59794

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw in the TeamCity web interface. TeamCity cloud agents periodically report metadata about their runtime environment back to the server. This agent-reported data is persisted server-side and later rendered on the cloud profile administration page. The application fails to properly encode or sanitize this data before injecting it into the HTML response.

An attacker who controls a registered build agent can supply crafted values containing HTML or JavaScript. When a TeamCity administrator or user with access to the cloud profile page loads that view, the injected payload executes in their browser under the TeamCity origin. The scope-changed impact reflects the ability to breach the security boundary between the compromised agent and the privileged administrative session.

Root Cause

The root cause is insufficient neutralization of input during web page generation. TeamCity trusted agent-supplied fields as safe display data and rendered them without applying context-appropriate output encoding. Because the data is stored on the server and served to every visitor of the cloud profile page, the payload persists across sessions until the underlying agent record is cleaned.

Attack Vector

Exploitation requires an attacker to register or compromise a TeamCity build agent that connects to the target server. The attacker embeds a JavaScript payload inside one of the reported agent fields consumed by the cloud profile page. A privileged user must then visit the affected page for the payload to execute. Successful exploitation allows the attacker to hijack the victim's session, forge administrative actions, exfiltrate build secrets, or pivot into connected source repositories.

No verified public exploit or proof-of-concept has been published. See the JetBrains Security Issues Fixed advisory for vendor guidance.

Detection Methods for CVE-2026-59794

Indicators of Compromise

Unexpected <script>, onerror, or onload fragments appearing in agent name, description, or environment metadata fields within TeamCity.
Outbound HTTP requests from administrator browsers to unfamiliar domains immediately after visiting the TeamCity cloud profile page.
New or modified TeamCity API tokens, user accounts, or build configurations created shortly after an administrator session on the cloud profile page.

Detection Strategies

Audit stored agent metadata in the TeamCity database for HTML control characters (<, >, ", ') in fields that should contain only alphanumeric identifiers.
Enable Content Security Policy (CSP) reporting on the TeamCity domain and monitor report-uri endpoints for inline script violations originating from /admin/ or cloud profile URLs.
Correlate agent registration events with subsequent administrative HTTP requests to identify session behavior anomalies.

Monitoring Recommendations

Forward TeamCity access logs and audit logs to a centralized SIEM and alert on cloud profile page access followed by privileged configuration changes.
Monitor build agent registration sources and flag agents originating from unexpected networks or accounts.
Track browser telemetry for TeamCity administrators, particularly anomalous DOM modifications on /admin/editCloudProfile.html and related endpoints.

How to Mitigate CVE-2026-59794

Immediate Actions Required

Upgrade TeamCity to version 2026.1.2 or later, which contains the vendor fix.
Review all registered build agents and remove any agents that are unrecognized, dormant, or associated with terminated accounts.
Rotate TeamCity administrator credentials and API tokens if agent metadata shows signs of tampering.

Patch Information

JetBrains addressed the vulnerability in TeamCity 2026.1.2. Administrators should download the update from the official JetBrains distribution channels and apply it following the standard TeamCity upgrade procedure. Refer to the JetBrains Security Issues Fixed page for the authoritative advisory.

Workarounds

Restrict the ability to register new build agents to trusted networks and vetted service accounts until the patch is deployed.
Limit access to the cloud profile administration page to a minimal set of accounts and require multi-factor authentication for those users.
Deploy a strict Content Security Policy that disallows inline script execution on the TeamCity web interface to reduce XSS impact.

bash

# Example: verify TeamCity server version after upgrade
curl -s -u admin:<token> \
  "https://teamcity.example.com/app/rest/server" \
  -H "Accept: application/json" | jq '.version'

# Expected output should show 2026.1.2 or later