Start with Identity
Subscribe
Identity CVE · Other

CVE-2024-27198JetBrains TeamCity 2024 authentication bypass, admin access

critical · CVSS 9.8CISA KEVActively exploited
Product: JetBrains TeamCity On-PremisesVendor: JetBrainsDisclosed: 2024-03-04Status: Actively exploitedNVD ↗CISA KEV ↗

What broke

TeamCity On-Premises accepted an unauthenticated request that became an administrator session. CVSS 9.8. Published 4 March 2024. Public estimates at the time put a large share of internet-facing instances in the exploited set. CISA added it to KEV. Cloud was not affected.

Why it matters

CI is an identity plane: cloud keys, signing certs, deployment tokens. TeamCity's 2023 bypass (CVE-2023-42793) was already a nation-state and ransomware favorite. The 2024 ID is the same product failing the same test. Our July 2026 TeamCity note (CVE-2026-63077) exists because this pattern did not stop.

What to do

  • Patch to the March 2024 TeamCity build. If the server was public in early March 2024, rotate every credential the build system could reach.
  • Review newly created admin users and SSH keys on agents.
  • Do not put TeamCity on the internet. Agent traffic can stay internal.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.