CVE-2024-23917: JetBrains TeamCity authentication bypass leading to RCE
The short version: JetBrains TeamCity — a widely used CI/CD server — has an authentication bypass (CVE-2024-23917) that an unauthenticated attacker can leverage to reach remote code execution. It's fixed in 2023.11.3. A build server is a high-value target, so if you run an affected version on the internet, patch and verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate — unauthenticated RCE on a CI/CD server (not currently KEV-listed) |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~53.73% · 98th percentile (2026-07-17) |
| In CISA KEV? | No — not listed at time of writing |
| Known exploited? | Not confirmed in the wild for this CVE |
| Vulnerability type | CWE-288 / CWE-306 authentication bypass → remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | JetBrains TeamCity before 2023.11.3 |
| Fixed in | 2023.11.3 |
What you need to know
TeamCity has improper access control on an API endpoint, which allows an unauthenticated attacker to bypass authentication. From there, the access is enough to reach remote code execution on the TeamCity server.
Why a build server makes this matter:
- CI/CD servers are crown jewels. TeamCity holds source code, build secrets, signing material, and deploy credentials — compromise can ripple into everything it builds and ships.
- It's pre-authentication. No credential, no chain — just a reachable, affected server.
A note on prioritization: this is a separate flaw from TeamCity's other, more infamous authentication bypasses. CVE-2024-23917 is not in CISA's KEV catalog at the time of writing, and we haven't confirmed in-the-wild exploitation specific to it — but its close cousins have been heavily exploited, so we don't treat an exposed, unpatched TeamCity as low-risk.
How serious we see it
Moderate — a Critical base score, tempered by current exploitation status.
The NVD scores it 9.8: unauthenticated, network-reachable code execution on a high-value server. We rate the practical severity High rather than Critical because, unlike TeamCity's KEV-listed bugs, this specific CVE isn't in KEV and we've seen no confirmed in-the-wild activity for it — while still treating it as urgent given the target. The bounded, reassuring part is that it affects specific versions, the fix is published, and exposure is quick to determine.
Recommendations
Straight from JetBrains' guidance:
- Patch now. Upgrade TeamCity to 2023.11.3 or later.
- Assume nothing if you were exposed — hunt. Review for unexpected administrative changes, new tokens, and signs of code execution on the server.
- If compromised, respond fully. Rotate build secrets, signing keys, and deploy credentials, and investigate downstream pipelines.
- Harden exposure. Keep the TeamCity server off the open internet where you can; restrict access to trusted networks.
- Confirm your exposure first. Verify whether you run an affected TeamCity version.
How BreachRisk sees it
BreachRisk discovers internet-facing TeamCity servers from little more than your domain, fingerprints the version from the application's responses, and flags exposure tied to this CVE. We detect and flag the exposed, affected version so an internet-facing build server is on your radar with the context that matters — not lost in a backlog.
That outside-in view is exactly what you want for CI/CD infrastructure, where an exposed server is a disproportionately valuable target.