Start with Identity
Subscribe
Identity CVE · Other

CVE-2023-42793JetBrains TeamCity 2023 authentication bypass to RCE

critical · CVSS 9.8CISA KEVActively exploited
Product: JetBrains TeamCity On-PremisesVendor: JetBrainsDisclosed: 2023-09-19Status: Actively exploitedNVD ↗CISA KEV ↗

What broke

TeamCity On-Premises before 2023.05.4 accepted an unauthenticated request that created an administrator token, then ran code. Discovered by Sonar. CVSS 9.8. Published 19 September 2023. CISA later confirmed Russian state use from that month. Cloud was not affected.

Why it matters

This is the CVE that taught a lot of identity and AppSec teams that CI credentials are production identity. CVE-2024-27198 and our 2026 TeamCity note are sequels. If you still have a public TeamCity, this history is your briefing.

What to do

  • You should already be far past 2023.05.4. If a forgotten 2023.x appliance is still up, take it down and rotate every secret it held.
  • Review admin users and SSH agent keys created in September 2023.
  • Keep TeamCity off the internet. The 2024 and 2026 IDs assume you did not learn this once.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.