TeamCity CVE-2026-63077: How an Authentication Bypass Exposed Build Pipelines

What Happened

On July 27, JetBrains disclosed CVE-2026-63077, a critical authentication bypass vulnerability in TeamCity On-Premises that allows remote code execution. This flaw affects all versions of TeamCity On-Premises before the patched releases (versions 2025.11.7 and 2026.1.3). TeamCity Cloud instances were not affected.

An attacker could bypass authentication, gain administrative access to the TeamCity server, and execute arbitrary code. In a CI/CD environment, this means direct access to build configurations, source code repositories, deployment credentials, and the ability to inject malicious code into every artifact your pipeline produces.

Timeline

• July 27: JetBrains publicly disclosed CVE-2026-63077 and released patches for TeamCity versions 2025.11.7 and 2026.1.3.
• Post-disclosure: Organizations running unpatched TeamCity On-Premises instances remain vulnerable to remote exploitation.

The immediate need to patch left no grace period. If you're running TeamCity On-Premises, you had to patch immediately or risk exposing your entire build pipeline.

Which Controls Failed or Were Missing

This vulnerability highlights gaps in three critical control areas:

1. Authentication enforcement

TeamCity's authentication mechanism had a flaw that allowed complete bypass. This wasn't about weak passwords or missing MFA. The application failed to properly validate authentication tokens or session state, allowing an attacker to access administrative functions without any credentials.

2. Network segmentation

Many organizations run their CI/CD infrastructure on the same network segments as development environments or with direct internet exposure. A "remote code execution" vulnerability is less dangerous when the affected system isn't remotely accessible. If your TeamCity instance was reachable from the internet or from compromised development workstations, the attack surface was wide open.

3. Vulnerability scanning and patch management

The fact that all versions prior to the July 27 patches were vulnerable suggests this flaw existed for some time. Organizations without continuous vulnerability assessment of their CI/CD tooling had no visibility into this exposure until public disclosure.

What the Standards Require

PCI DSS v4.0.1 Requirement 6.3.2 mandates that security vulnerabilities are identified and addressed through a formal process. For custom software, including your CI/CD infrastructure configuration, you must identify security vulnerabilities using industry-recognized processes. This includes:

• Maintaining an inventory of all software components (your TeamCity version qualifies)
• Monitoring public vulnerability databases and vendor security advisories
• Applying critical patches within defined timeframes based on risk

OWASP ASVS v4.0.3 Section 4.1 requires that authentication controls fail securely and cannot be bypassed. Specifically, V4.1.1 states that applications verify that users are authenticated before allowing access to protected functionality. An authentication bypass vulnerability directly violates this requirement.

ISO 27001 Control 8.8 requires organizations to obtain timely information about technical vulnerabilities of information systems in use, evaluate exposure to such vulnerabilities, and take appropriate measures to address the associated risk. For a critical RCE vulnerability in your CI/CD platform, "appropriate measures" means emergency patching.

NIST 800-53 Rev 5 SI-2 requires organizations to identify, report, and correct system flaws, test software updates for effectiveness and potential side effects, and install security-relevant updates within organization-defined time periods. For a critical vulnerability with public exploit potential, that time period should be measured in hours, not days.

Lessons and Action Items for Your Team

Immediate actions:

1. Audit your TeamCity deployment now. Run cat /opt/TeamCity/webapps/ROOT/WEB-INF/buildServerSpringContext.xml | grep version or check your admin panel. If you're not on 2025.11.7 or 2026.1.3 (or later), you're vulnerable. Patch immediately.

2. Review network exposure. Your CI/CD infrastructure should never be directly accessible from the internet. Place TeamCity behind a VPN or use network segmentation with strict firewall rules. If you must expose it externally, implement a reverse proxy with additional authentication layers.

3. Check your build logs for anomalies. Look for unexpected administrative actions, new user accounts, modified build configurations, or builds triggered from unknown sources. An attacker with admin access could have injected malicious steps into your build process.

Systemic improvements:

4. Implement continuous monitoring for your CI/CD stack. Your vulnerability scanner probably checks web applications and servers, but does it track your TeamCity version? Add your CI/CD tools to your asset inventory and monitor vendor security advisories. Set up alerts for JetBrains security bulletins.

5. Define emergency patch procedures for CI/CD infrastructure. You can't wait for your monthly patch cycle when a critical RCE drops. Document who has authority to approve emergency maintenance windows, how to test patches in a staging environment quickly, and communication protocols for notifying development teams.

6. Segment your build environment. Your build agents should run in isolated network segments with strict egress controls. If an attacker compromises a build agent through malicious code in a dependency, network segmentation limits their ability to pivot to production systems or exfiltrate data.

7. Implement artifact signing and verification. Even if an attacker injects malicious code into your build process, cryptographic signing of artifacts provides a detection mechanism. Require signatures on all artifacts before deployment, and rotate signing keys regularly.

Compliance mapping:

Document this incident in your risk register. When your next audit asks how you comply with PCI DSS Requirement 6.3.2 or ISO 27001 Control 8.8, point to your response timeline: how quickly you identified affected systems, applied patches, and verified the fix. If you didn't patch quickly, document why and what you'll change.

The authentication bypass in CVE-2026-63077 wasn't sophisticated. It didn't require deep expertise to exploit. That's what makes it dangerous. Your CI/CD pipeline is the most privileged system in your infrastructure. It has access to source code, secrets, and deployment credentials. Treat vulnerabilities in these systems as the emergencies they are.