>> All posts

CVE-2024-27198: JetBrains TeamCity authentication bypass, mass-exploited

The short version: JetBrains TeamCity On-Premises shipped with two flaws disclosed together — an authentication bypass (CVE-2024-27198) and a path traversal (CVE-2024-27199). The bypass lets an unauthenticated attacker reach administrative endpoints and create rogue admin accounts, which on a CI/CD server means control of your builds and secrets. Both were mass-exploited and both are in CISA's KEV catalog. If you run TeamCity below 2023.11.4, patch and then check for accounts you didn't create. Steady hands — but move.

At a glance

FactDetail
Our severity takeHigh — in practice and on paper
CVSS v3.1 (NVD)9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (CVE-2024-27198)
Companion flawCVE-2024-27199 — 7.3 High · AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L (path traversal, limited admin actions)
EPSS~99.94% · 99.97th percentile (2026-07-17) for CVE-2024-27198
In CISA KEV?Yes — CVE-2024-27198 remediation was due 2024-03-28; CVE-2024-27199 due 2026-05-04
Known exploited?Yes — mass exploitation, rogue admin accounts created; associated with ransomware activity
Vulnerability typeCWE-288 authentication bypass → admin takeover; CWE-22 path traversal (companion)
Requires authenticated session?No — pre-authentication
AffectedJetBrains TeamCity On-Premises before 2023.11.4
Fixed in2023.11.4 (and later)

What you need to know

TeamCity is a CI/CD build server — the machine that compiles your code, holds deployment credentials, and pushes artifacts. That makes it a high-value target: control the build server and you can reach source, secrets, and everything downstream of the pipeline.

CVE-2024-27198 is the serious one. It's an authentication bypass in the web component that lets an unauthenticated attacker reach endpoints that should require an admin session — including the ones that create users and generate access tokens. In the wild, attackers used it to stand up their own administrator accounts. CVE-2024-27199 is a path traversal that permits a narrower set of unauthenticated admin actions; BreachRisk fingerprints exposure to this pair.

  • It's a build server. Admin control reaches your code, your pipeline, and the credentials it stores — not just one host.
  • It's pre-authentication and internet-reachable. Many TeamCity consoles are exposed for remote developers; no credential or chain is needed.
  • It was live at scale. Public exploitation followed disclosure quickly, so an unpatched, exposed instance may already have been touched.

How serious we see it

High — the 9.8 is not hyperbole here.

Unauthenticated administrative takeover of a CI/CD server, confirmed exploited in the wild, is top-of-queue. The bounded, reassuring part is that it's narrow and fixable: it affects TeamCity On-Premises below 2023.11.4, the fix is published, and exposure is quick to determine. The catch is the usual one for a mass-exploited flaw — being patched and being clean are separate questions, so check for rogue accounts and tokens after you upgrade.

Recommendations

Straight from JetBrains' guidance and CISA:

  1. Patch now. Upgrade TeamCity On-Premises to 2023.11.4 or later. (TeamCity Cloud was addressed by JetBrains.)
  2. Hunt for abuse. Review administrator accounts, access tokens, and audit logs for entries you don't recognize — attackers created their own admin users.
  3. If you find evidence of compromise, respond. Rotate all credentials and tokens stored in or reachable from TeamCity, and review recent builds and deployments for tampering.
  4. Reduce exposure. Keep the TeamCity console off the open internet where you can; restrict it to trusted networks or a VPN.
  5. Confirm your exposure first. Verify whether you run an internet-facing TeamCity On-Premises server, and which version.

How BreachRisk sees it

BreachRisk starts from the outside, the way an attacker does. From little more than your domain it discovers internet-facing TeamCity login panels, fingerprints the version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this pair — surfaced at the top of your results because it's in KEV and because a build server earns priority. We detect and flag the exposed, affected instance; we don't exploit it.

That outside-in, continuous view is the point: when a CI/CD flaw is being mass-exploited, the exposed server is already mapped, so you can go straight to patch-and-verify.

References

See your cyber risk, proven.