JetBrains TeamCity (CVE-2024-27198).

An authentication bypass in JetBrains TeamCity on-premises that lets unauthenticated attackers take over administrative access and execute code as the build server. It belongs to the Vulnerabilities category of cybersecurity.

An authentication bypass in JetBrains TeamCity on-premises that lets unauthenticated attackers take over administrative access and execute code as the build server.

CVE-2024-27198 is a critical authentication bypass in JetBrains TeamCity on-premises servers disclosed in March 2024 by Rapid7. The flaw allows an unauthenticated attacker reaching the TeamCity web interface to access protected endpoints, create an administrator account and execute arbitrary code on the build server. Because TeamCity stores source code, secrets and signs artifacts, a compromise can cascade into a software supply-chain attack. Mass exploitation began within days of disclosure, with state-aligned and ransomware actors deploying webshells and miners. Mitigation requires upgrading to TeamCity 2023.11.4 or applying the official security patch, then auditing accounts, plugins and build artifacts.

Defences for JetBrains TeamCity (CVE-2024-27198) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: CVE-2024-27198, TeamCity auth bypass.