CVE-2026-111096 in TeamCity
Summary
by MITRE • 10/15/2026
In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 stored XSS in the classic build log was possible
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified as a Stored Cross-Site Scripting (XSS) flaw within JetBrains TeamCity prior to version 2026.2 represents a significant security risk for organizations relying on this continuous integration and deployment platform. This specific weakness resides in the classic build log interface, where user-supplied data is processed without adequate sanitization or encoding before being rendered back into the browser environment. Unlike reflected XSS attacks that require tricking a user into clicking a malicious link, stored XSS persists within the application's database or file system. Consequently, every time an authorized user accesses the affected build logs, the injected script payload executes automatically in their context. This persistence mechanism amplifies the severity of the vulnerability because it does not depend on social engineering tactics to trigger; rather, exploitation occurs simply by viewing the compromised log entry, potentially affecting multiple users over a prolonged period if left unpatched.
From a technical perspective, this flaw aligns with CWE-79, which categorizes improper neutralization of input during web page generation as Cross-site Scripting. The root cause typically involves insufficient validation or encoding of special characters such as angle brackets, quotes, and ampersands within the build output streams that are displayed in the classic log viewer. When these characters are not properly escaped, they can be interpreted by the browser's rendering engine as executable HTML or JavaScript code rather than plain text. This allows an attacker who has write access to the build logs—often through a compromised CI/CD pipeline step or a malicious script within a project—to inject arbitrary client-side scripts. These scripts run with the same privileges and session cookies as the viewing user, effectively bypassing standard browser security policies like the Same-Origin Policy because the code originates from the trusted domain of the TeamCity server itself.
The operational impact of this vulnerability is substantial, particularly in enterprise environments where sensitive build artifacts or deployment configurations are managed through TeamCity. An attacker leveraging this flaw can perform session hijacking by stealing authentication cookies and tokens stored in local storage or accessed via JavaScript APIs. This could lead to unauthorized access to the CI/CD platform, allowing further manipulation of builds, injection of malicious code into production pipelines, or exfiltration of sensitive source code and credentials embedded within build logs. Furthermore, attackers can use the executed scripts to perform actions on behalf of the victim user, such as modifying project settings, creating new users with administrative privileges, or redirecting traffic to phishing sites designed to harvest additional credentials. In environments where TeamCity is integrated with other tools via webhooks or APIs, this initial foothold could serve as a pivot point for broader network compromise.
This vulnerability maps directly to the MITRE ATT&CK technique T1059.007, which covers JavaScript execution within browser-based applications. The attack vector falls under Initial Access and Execution phases, specifically leveraging trusted software vulnerabilities to gain persistence or privilege escalation without triggering typical intrusion detection systems that focus on external network traffic. Because the payload is stored server-side, it evades many client-side security controls and web application firewalls that inspect only incoming request payloads rather than rendered output content. The lack of immediate user interaction required for exploitation makes this a high-risk issue that demands urgent attention from development teams responsible for maintaining CI/CD infrastructure integrity.
Mitigation strategies must prioritize the immediate upgrade to JetBrains TeamCity version 2026.2 or any later release where this specific flaw has been addressed through improved input validation and output encoding mechanisms within the classic build log renderer. For organizations unable to patch immediately, implementing a Web Application Firewall (WAF) with rules capable of detecting and blocking script injection patterns in HTTP responses may provide temporary relief, though such measures are often brittle against obfuscated payloads. Additionally, enabling Content Security Policy headers that restrict inline script execution can significantly reduce the impact by preventing unauthorized JavaScript from running even if injected into the DOM. Regular audits of build scripts to ensure they do not output untrusted data directly into log files without proper escaping are also recommended as a defense-in-depth measure. Ultimately, treating CI/CD platforms with the same security rigor as public-facing web applications is essential to prevent these types of persistent threats from compromising the software supply chain.