Critical TeamCity Flaw Could Let Attackers Run OS Commands Without Logging In TeamCity关键漏洞可能允许攻击者在无需登录的情况下运行操作系统命令

TL;DR

• A critical vulnerability (CVE-2026-63077, CVSS 9.8) in TeamCity On-Premises allows unauthenticated remote code execution via the agent polling protocol, bypassing authentication checks.
• The flaw affects all on-premise versions and was patched in versions 2025.11.7 and 2026.1.3; a security patch plugin is also available for older versions (2017.1+).
• No evidence of exploitation in the wild, but JetBrains recommends upgrading to the latest version and implementing additional security layers like VPNs or restricting internet-facing access.
• The vulnerability could lead to data exposure, credential theft, or server state modification depending on the privileges of the TeamCity server process.

Why It Matters

This vulnerability poses a severe risk to CI/CD pipelines and DevOps environments, as it enables attackers to execute arbitrary commands without authentication—potentially compromising entire development workflows and sensitive infrastructure. For AI practitioners and enterprise teams relying on automated build systems, this underscores the importance of securing internal tools against remote exploits, especially when exposed to the internet. Prompt patching and network hardening are essential to prevent supply chain attacks or lateral movement within secure environments.

Technical Details

• Vulnerability type: Unauthenticated remote code execution (RCE) via the agent polling protocol in TeamCity On-Premises.
• Affected versions: All TeamCity On-Premises versions prior to 2025.11.7 and 2026.1.3.
• Patch availability: Fixed in versions 2025.11.7 and 2026.1.3; a dedicated security patch plugin released for versions 2017.1+.
• Exploitation vector: HTTP(S) access to TeamCity servers; no login required to trigger the flaw.
• Impact: Full system compromise possible if the TeamCity server process runs with elevated privileges; potential exposure of configurations, credentials, and stored data.
• Discovery credited to Antoni Tremblay, reported on July 10, 2026.

Industry Insight

Organizations using TeamCity should prioritize immediate upgrades or apply the patch plugin, even if they believe their instances are isolated—since any internet-facing entry point increases risk. This incident highlights the growing need for zero-trust architectures in DevOps tooling, where authentication and network segmentation must be enforced rigorously. As CI/CD platforms become central to software delivery—including AI model training pipelines—security updates must be treated with the same urgency as application patches to prevent cascading breaches across development and deployment ecosystems.

TL;DR

• JetBrains 发现 TeamCity 存在严重安全漏洞（CVE-2026-63077），允许未认证攻击者通过 HTTP(S) 访问执行任意操作系统命令。
• 该漏洞影响所有本地部署版本，CVSS 评分高达 9.8，涉及绕过身份验证和远程代码执行风险。
• 已发布修复版本 2025.11.7 和 2026.1.3，并提供兼容旧版的安全补丁插件供无法升级的用户使用。
• 建议企业加强访问控制，如启用 VPN 或额外安全措施，避免暴露登录界面或 REST API 接口。
• 目前无证据表明该漏洞已被利用，但需警惕其作为 CI/CD 系统潜在入口点的风险。

为什么值得看

本文揭示了一个高危的 CI/CD 平台安全漏洞，直接影响开发流程中的自动化构建与部署环境，对 DevOps 团队和企业软件供应链安全构成直接威胁。及时理解此漏洞机制及应对措施，有助于防止敏感数据泄露、配置篡改甚至服务器被完全接管，是保障现代软件开发基础设施安全的关键参考。

技术解析

• 漏洞位于 TeamCity On-Premises 的代理轮询协议中，攻击者可无需身份验证即可触发远程代码执行，权限等同于 TeamCity 服务进程本身。
• CVSS 评分为 9.8（严重级别），属于“未经授权的远程代码执行”类型，可利用网络可达性直接发起攻击，无需用户交互。
• 修复方案包括更新至指定版本（2025.11.7 / 2026.1.3）或使用针对 2017.1+ 版本的独立安全补丁插件，后者仅解决当前 CVE 问题，不涵盖其他更新。
• 受影响范围覆盖所有本地部署实例，云端版本已提前修复；未发现实际野外利用案例，但风险敞口广泛存在于开放公网的 TeamCity 服务端。
• 潜在后果包括暴露项目配置、存储凭证、修改构建状态等，可能进一步横向渗透至内部网络或破坏持续集成流水线完整性。

行业启示

• CI/CD 工具应被视为关键基础设施，其安全性直接影响整个软件交付链的安全基线，厂商需建立更严格的漏洞响应与透明披露机制。
• 企业应实施最小暴露原则，避免将 TeamCity 等管理接口直接置于公网，优先采用内网隔离、双向认证或零信任架构强化边界防护。
• 安全补丁策略不能仅依赖单一修复手段，应结合版本升级、临时补丁、网络限制等多层防御，并定期审查第三方组件的安全状态以预防类似风险累积。