Code Execution Vulnerability in JetBrains TeamCity
CVE-2026-100253

8.8HIGH

Key Information:

Vendor

Jetbrains
Status
Teamcity
Vendor
CVE Published:
30 September 2026

What is CVE-2026-100253?

A security flaw in JetBrains TeamCity prior to versions 2026.2, 2026.1.4, and 2025.11.8 allows a sandbox escape, enabling unauthorized code execution through the use of versioned settings in Kotlin DSL. This vulnerability could lead to significant security risks and potential unauthorized access, highlighting the importance of timely updates and security measures to protect sensitive data.

Affected Version(s)

TeamCity 0 < 2026.2, 2026.1.4, 2025.11.8

References

https://www.jetbrains.com/privacy-security/issues-fixed/

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.