CVE-2026-65907 in TeamCity
Summary
by MITRE • 07/23/2026
In JetBrains TeamCity before 2026.1.2, 2025.11.6 code execution in Git VCS roots was possible
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 07/23/2026
JetBrains TeamCity versions prior to 2026.1.2 and 2025.11.6 contained a critical vulnerability in the Git version control system integration that allowed remote attackers to execute arbitrary code on the TeamCity server through maliciously crafted repository configurations. This vulnerability specifically affected how TeamCity handled Git VCS roots, creating an environment where unauthenticated attackers could inject and execute malicious commands within the context of the TeamCity service account. The flaw stemmed from insufficient input validation and sanitization when processing Git repository URLs and configuration parameters, enabling attackers to manipulate the underlying Git operations to trigger code execution. This vulnerability aligns with CWE-78, which describes improper neutralization of special elements used in OS commands, and represents a classic command injection attack vector that could be exploited without requiring authentication or elevated privileges.
The technical exploitation of this vulnerability occurred through the manipulation of Git VCS root configurations where attackers could inject malicious command sequences into repository URLs or related parameters. When TeamCity processed these malformed inputs during Git operations such as cloning, fetching, or other repository interactions, the system would execute the injected commands with the privileges of the TeamCity service account. This created a significant attack surface since TeamCity servers often run with elevated permissions to manage build agents and access various system resources. The vulnerability was particularly dangerous because it could be triggered through the web interface or API endpoints that allowed VCS root configuration modifications, making it accessible to users with minimal privileges or even unauthenticated attackers depending on the server configuration.
The operational impact of this vulnerability extended beyond simple code execution to potentially compromise entire build environments and development infrastructure. Attackers could leverage this vulnerability to gain persistent access to TeamCity servers, modify build configurations, steal sensitive credentials stored in repository settings, or even escalate privileges to access underlying systems. The attack chain typically involved creating a malicious Git repository with specially crafted URLs that would be processed by TeamCity during normal operations, allowing attackers to execute arbitrary commands on the server. This vulnerability affected organizations using TeamCity for continuous integration and deployment workflows, potentially exposing source code repositories, build artifacts, and sensitive data processing pipelines to unauthorized access. The risk was compounded by the fact that many organizations use TeamCity in production environments where it has extensive access to internal networks and resources.
Organizations should immediately upgrade to TeamCity version 2026.1.2 or 2025.11.6 to remediate this vulnerability, as these releases include proper input validation and sanitization mechanisms for Git VCS root configurations. System administrators should also implement network segmentation and access controls to limit exposure of TeamCity servers to untrusted networks, while monitoring for suspicious repository configuration changes or unusual Git operations. Additional mitigations include restricting user permissions to modify VCS roots, implementing strict input validation at the network level, and conducting regular security assessments of build environments. The vulnerability demonstrates the importance of validating all external inputs in CI/CD systems and aligns with ATT&CK technique T1059.001 for executing malicious code through command injection attacks. Organizations should also consider implementing automated security scanning tools to identify similar vulnerabilities in their CI/CD pipelines and ensure that all third-party integrations undergo proper security reviews before deployment.