In March 2024, JetBrains disclosed CVE-2024-27198, an authentication bypass vulnerability affecting TeamCity On-Premises servers [1]. Unpatched servers can be exploited by unauthenticated attackers to gain administrative privileges [2]. Because TeamCity is used for software build pipelines, a compromise could impact the downstream software supply chain; organizations should update immediately and audit for anomalous accounts [2].
Backfill: this event became public on Mar 4, 2024 and we added it on Nov 8, 2026. It is not a new event.
JetBrains Discloses TeamCity Authentication Bypass Vulnerability CVE-2024-27198
1 min read
- Disclosed
- Mar 4, 2024
- Published
- Nov 8, 2026
- Last updated
- Nov 12, 2026
- CVSS basis
- Our assessment
- 99.9%, higher than 100% of CVEs
- Exploitation and patch status
- Patch available
- Attack vector
- Vulnerability status
- Actor type
- Motivation
On this page
30-second summary
What happened
Who is affected
Organisations running: JetBrains TeamCity On-Premises
What to do nowOur advice
Because TeamCity is used for software builds, a compromise can further impact the software supply chain; update immediately and check for abnormal accounts [2].
Affected scope
| Affected scope | Versions | Fixed in | |
|---|---|---|---|
| JetBrains TeamCity On-Premises | 見 JetBrains 安全公告[1] | — | ✗ Unpatched |
Do you run this product?
Add it to your systems list and we'll email you about related advisories and major updates.
Timeline
- JetBrains discloses CVE-2024-27198[1]
Technical details
Source-Supported Details
Upgrade immediately and inspect for newly created users, access tokens, and build configuration modifications [1].
Source excerpt: "In addition to important security fixes, version 2023.11.4 addresses several regular issues, including decreased TeamCity performance when the server cannot reach the jetbrains.com domain, a broken build log when publishing caches is aborted due to an error, inability to process " [1].
References
Official / primary2
- [1]
“In addition to important security fixes, version 2023.11.4 addresses several regular issues, including decreased TeamCity performance when the server cannot reach the jetbrains.com domain, a broken build log when publishing caches is aborted due to an error, inability to process ”
- [2]
Corrections
- · countries: 攻擊來源：捷克 → 原本把捷克標成攻擊來源，但來源沒有指出攻擊者來自捷克或受其支持，因此移除。
This site aggregates public information and is not security consulting advice. Test remediation steps before applying.