# JetBrains TeamCity 2023 authentication bypass to RCE

Source: https://startwithidentity.com/cves/cve-2023-42793/
Last updated: 2026-08-29
License: content by Start with Identity. Cite the source URL.

---

## What broke

TeamCity On-Premises before 2023.05.4 accepted an unauthenticated request that created an administrator token, then ran code. Discovered by Sonar. CVSS 9.8. Published 19 September 2023. CISA later confirmed Russian state use from that month. Cloud was not affected.

## Why it matters

This is the CVE that taught a lot of identity and AppSec teams that CI credentials are production identity. [CVE-2024-27198](https://startwithidentity.com/cves/cve-2024-27198/) and our [2026 TeamCity note](https://startwithidentity.com/blog/2026-07-27-jetbrains-teamcity-authentication-bypass-rce/) are sequels. If you still have a public TeamCity, this history is your briefing.

## What to do

- You should already be far past 2023.05.4. If a forgotten 2023.x appliance is still up, take it down and rotate every secret it held.
- Review admin users and SSH agent keys created in September 2023.
- Keep TeamCity off the internet. The 2024 and 2026 IDs assume you did not learn this once.

## After you patch

A build system holds the credentials to ship your software, so an unauthenticated bypass here is a [software supply chain](https://startwithidentity.com/glossary/secrets-management/) event rather than one compromised host.

- **Rotate every secret the server held**: signing keys, registry and cloud credentials, deploy tokens, and any [service account](https://startwithidentity.com/glossary/service-account/) it authenticated as.
- **Review build history for injected steps** during the exposure window, and compare published artifacts against expected hashes.
- **Revoke sessions and administrative tokens** rather than only resetting passwords.
- **Check for accounts and API tokens created during the window**, which is the standard persistence step after this class of bypass.

## Sources

- [NVD: CVE-2023-42793](https://nvd.nist.gov/vuln/detail/CVE-2023-42793)
- CISA KEV / December 2023 update
- Sonar / JetBrains advisories