CVE-2026-106219 in TeamCity
Summary
by MITRE • 10/06/2026
In JetBrains TeamCity before 2026.2.1 missing validation of Git submodule URLs allowed reading local repositories on the server
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/06/2026
The vulnerability identified in JetBrains TeamCity versions prior to 2026.2.1 stems from a critical failure in input validation regarding Git submodule configurations. Specifically, the application did not adequately sanitize or validate Uniform Resource Locators (URLs) provided for Git submodules during repository synchronization operations. This oversight allows an authenticated user with permission to configure build steps or project settings involving Git sources to specify local file system paths instead of remote repository URLs. By exploiting this lack of validation, a malicious actor can instruct the TeamCity server to access and read files from its own local disk infrastructure.
From a technical perspective, this flaw represents a classic instance of path traversal combined with insecure direct object references in the context of version control integration tools. When TeamCity processes a Git submodule URL that points to a local directory using file scheme protocols such as file:/// or relative paths without proper isolation, it effectively bypasses network-based security controls and sandboxing mechanisms designed to restrict access to remote resources only. The server executes commands against these local paths with the privileges of the service account running TeamCity processes, thereby granting elevated read access to sensitive data residing on the host machine.
The operational impact of this vulnerability is severe for organizations relying on TeamCity for continuous integration and deployment pipelines. An attacker can exfiltrate configuration files containing hardcoded credentials, API keys, or private SSH keys stored in repository metadata or project settings directories. Furthermore, they may read proprietary source code, internal documentation, or other sensitive artifacts that have been cached locally by the build agents or server processes. This compromise undermines the confidentiality and integrity of the entire software development lifecycle managed through the platform, potentially leading to further exploitation if extracted secrets are used to pivot into other systems within the enterprise network.
This vulnerability aligns with Common Weakness Enumeration (CWE) categories such as CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-798 Use of Hard-coded Credentials, particularly when local repositories contain sensitive authentication material. In terms of the MITRE ATT&CK framework, this behavior maps to T1083 File and Directory Discovery and potentially T1552 Unsecured Credentials if private keys or tokens are accessed from local storage locations like .git/config files. The attack vector is classified as Local Access with Privileges Required, indicating that an insider threat or a compromised user account within the TeamCity environment is necessary to initiate the exploit.
Mitigation strategies primarily involve upgrading to JetBrains TeamCity version 2026.2.1 or later, where this validation logic has been corrected to reject non-remote URLs for Git submodules unless explicitly permitted by strict administrative policies that enforce additional security checks. Administrators should also implement network-level restrictions on build agents and server processes to prevent outbound connections to local file systems via loopback interfaces if such access is not strictly required for legitimate operations. Regular auditing of project configurations and repository sources can help detect any attempts to introduce malicious submodule URLs before they are executed during builds. Additionally, employing principle of least privilege ensures that even if an attacker gains control over build configurations, the impact is limited by restricting file system permissions associated with the TeamCity service account.