CVE-2026-59796: JetBrains TeamCity Privilege Escalation

CVE-2026-59796 Overview

CVE-2026-59796 is an authorization flaw in JetBrains TeamCity versions before 2026.1.2. The vulnerability stems from improper permission checks that allow authenticated users to modify pipeline configurations without holding the required privileges. This weakness maps to [CWE-862] Missing Authorization. An attacker with low-privilege network access to a TeamCity server can alter build pipeline definitions, impacting build integrity and downstream artifacts. JetBrains addressed the issue in TeamCity 2026.1.2 and published details on its security issues page.

Critical Impact
Authenticated attackers can modify CI/CD pipeline definitions, enabling tampering with builds, injection of malicious steps, and compromise of software supply chain integrity.

Affected Products

JetBrains TeamCity versions prior to 2026.1.2
On-premises TeamCity servers hosting build pipelines
CI/CD environments integrated with vulnerable TeamCity instances

Discovery Timeline

2026-07-10 - CVE-2026-59796 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-59796

Vulnerability Analysis

The vulnerability resides in TeamCity's authorization logic for pipeline modification operations. The server fails to correctly validate whether an authenticated user holds the permissions required to change pipeline definitions. As a result, users with lower privilege levels can perform actions that should be restricted to project administrators or users with explicit edit rights.

Pipeline definitions in TeamCity drive build steps, environment variables, agent selection, and artifact publishing. Unauthorized modification of these definitions can introduce malicious build steps, exfiltrate secrets referenced in build parameters, or alter artifacts distributed downstream. Because TeamCity commonly integrates with source repositories, deployment targets, and package registries, tampered pipelines extend the blast radius across the software supply chain.

The issue is exploitable over the network against the TeamCity web interface or API. Exploitation requires authenticated access but no user interaction. Confidentiality and integrity impacts are high, while availability is not directly affected.

Root Cause

The root cause is a missing or incomplete authorization check on the code paths that handle pipeline configuration changes. The server accepts modification requests without verifying that the caller has the edit project or equivalent permission scoped to the target project.

Attack Vector

An attacker authenticates to the TeamCity server using any valid low-privilege account, then issues requests to the pipeline modification endpoints. Because the permission check is inadequate, the server processes the request and persists the changes. See the JetBrains Security Issues Fixed advisory for vendor-published details.

// No verified proof-of-concept is publicly available at this time.
// The vulnerability manifests when authenticated requests to pipeline
// modification endpoints bypass the project-level permission check.

Detection Methods for CVE-2026-59796

Indicators of Compromise

Unexpected changes to pipeline or build configuration objects in TeamCity audit logs
New or modified build steps referencing external scripts, unusual shell commands, or outbound network calls
Configuration edits performed by user accounts that historically only trigger or view builds
Newly added service connections, tokens, or SSH keys attached to existing pipelines

Detection Strategies

Review the TeamCity audit log for EDIT_PROJECT, EDIT_BUILD_CONFIGURATION, and settings changes performed by non-administrator accounts.
Compare current pipeline definitions against version-controlled baselines to identify unauthorized drift.
Alert on modifications to build scripts, parameters, and secure tokens outside approved change windows.

Monitoring Recommendations

Forward TeamCity server and audit logs to a centralized SIEM for correlation with authentication events.
Monitor the TeamCity REST API for high-frequency configuration write operations from a single session.
Track egress from build agents for anomalous destinations following pipeline edits.

How to Mitigate CVE-2026-59796

Immediate Actions Required

Upgrade all TeamCity servers to version 2026.1.2 or later without delay.
Rotate credentials, tokens, and SSH keys stored in TeamCity if unauthorized pipeline edits are suspected.
Audit user role assignments and remove unnecessary project-level access.
Review recent pipeline changes and revert any modifications that cannot be attributed to authorized activity.

Patch Information

JetBrains resolved the improper permission check in TeamCity 2026.1.2. Consult the JetBrains Security Issues Fixed page for the vendor advisory and version guidance. Apply the patched build to on-premises servers and validate that the fix is present before returning the server to production use.

Workarounds

Restrict network access to the TeamCity web interface and API to trusted administrators until the patch is applied.
Enforce least privilege by removing edit-capable roles from users who do not require pipeline modification rights.
Require multi-factor authentication for all TeamCity accounts to limit low-privilege account abuse.
Store pipeline definitions in versioned settings backed by a source repository to detect unauthorized changes.

bash

# Verify TeamCity server version after upgrade
curl -u <admin>:<token> \
  https://<teamcity-host>/app/rest/server \
  -H "Accept: application/json" | jq '.version'

# Expected output should reflect version 2026.1.2 or later