TeamCity authentication bypass
CI infrastructure is a trust amplifier: a small administration surface can influence builds, artifacts, and deployment credentials. This is why severity calibration should consider the system’s role, not just the visible endpoint. The archive retains the…
- Original severity
- critical; CVSS 9.8 source-reported; not rescored by vulns.co
- Public source
- github advisory
- Program / vendor
- JetBrains
- Product / surface
- TeamCity continuous-integration server
- Weakness
- Authentication bypass using an alternate path or channel · CWE-288
- Affected boundary
- authentication gate to CI administration boundary
- Disclosure date
- 2024-03-04
- Public status checked
- 2026-09-10
What the evidence established
The advisory identifies an authentication bypass that could enable administrative actions on affected CI servers.
Why the impact was credible
The source rates the issue Critical with CVSS 9.8; CI systems can be trusted by source, build, and deployment workflows.
Durable engineering lesson
CI infrastructure is a trust amplifier: a small administration surface can influence builds, artifacts, and deployment credentials. This is why severity calibration should consider the system’s role, not just the visible endpoint. The archive retains the published classification and directs readers toward patch and access-control validation rather than any exploitation path.
Control pattern
Upgrade to the fixed version, remove public exposure where not required, rotate or review CI credentials according to response policy, and validate access controls after maintenance.
Primary public disclosure
Upstream availability and wording can change. Public status was last checked 2026-09-10.