CVE-2026-28196: 
JetBrains TeamCity vulnerability analysis and mitigation

CVE-2026-28196 is an incomplete cleanup vulnerability in JetBrains TeamCity that causes a credentials configuration file to remain on disk after versioned settings are disabled. It affects all JetBrains TeamCity versions before 2025.11.3. The vulnerability was disclosed on February 25, 2026, with the CVE assigned by JetBrains s.r.o. It carries a CVSS v3.1 base score of 2.3 (Low), as assessed by JetBrains (JetBrains Advisory, NVD).

The root cause is classified as CWE-459 (Incomplete Cleanup): when a user disables versioned settings in TeamCity, the application fails to remove the associated credentials configuration file from disk, leaving sensitive credential data as a residual artifact. Exploitation requires local access to the TeamCity server and high-privilege credentials, limiting the attack vector to local (AV:L). An attacker with sufficient local privileges could read the abandoned credentials file directly from the filesystem. No public proof-of-concept or detailed technical write-up has been identified (JetBrains Advisory, NVD).

Successful exploitation results in a low-severity confidentiality impact: an attacker with high-privilege local access could recover credentials stored in the abandoned configuration file, potentially enabling unauthorized access to integrated systems or lateral movement within the environment. There is no impact on system integrity or availability. The scope is limited to the TeamCity server host and the systems whose credentials were stored in the versioned settings configuration (JetBrains Advisory, NVD).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of disclosure. The EPSS score is extremely low at 0.00001, reflecting minimal exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation is further constrained by the requirement for high-privilege local access to the TeamCity server (JetBrains Advisory, NVD).

JetBrains has released a fix in TeamCity version 2025.11.3; organizations should upgrade to this version or later as the primary remediation. For systems running vulnerable versions prior to patching, administrators should manually locate and remove residual credentials configuration files left on disk after disabling versioned settings. Additionally, reviewing access controls to ensure only authorized high-privileged users can access TeamCity configuration directories, and implementing file integrity monitoring on those directories, is recommended (JetBrains Advisory).