JetBrains TeamCity: a critical auth bypass leading to RCE on your CI/CD server

> In short: JetBrains warns of a critical authentication bypass vulnerability in TeamCity On-Premises that could be exploited to achieve remote code execution. TeamCity is a CI/CD server — a compromise gives the attacker access to build pipelines, deployment credentials, source code, and the deployment keys for every environment the server can reach. Fix available.

Why this matters to you

If your engineering team self-hosts TeamCity for CI/CD (many enterprise and regulated environments do, for sovereignty reasons), this is a supply-chain incident waiting to happen. A CI/CD server compromise is the SolarWinds pattern at team scale: the attacker gets your source code, your build artifacts, and your deployment credentials in one move.

This follows the same pattern as the GitLab RCE we covered — self-hosted dev infrastructure with an authentication bypass that leads to code execution. The common thread: these platforms were designed for the intranet and are routinely exposed to the internet.

The flaw and its impact

An authentication bypass lets an unauthenticated attacker reach authenticated functionality on the TeamCity server. From there, the path to RCE depends on the server's configuration, but the CI/CD context makes the impact severe regardless:

What to do

The CI/CD attack surface pattern

TeamCity, GitLab, Jenkins, GitHub Actions runners — every major CI/CD platform has had a critical auth bypass or RCE in the past 18 months. The reason is structural: CI/CD servers are high-value targets (they hold every secret in the engineering org) with complex permission models and historical internet exposure. For a SaaS vendor, the operational answer is consistent: self-hosted CI/CD belongs behind a VPN, on a short patch cycle, with its secrets in a dedicated vault — not in build variables.