CVE-2025-26492 is a High severity flaw (CVSS 7.7) in JetBrains TeamCity before 2024.12.2. The record says improper Kubernetes connection settings could expose sensitive resources. Upgrade to TeamCity 2024.12.2 or later, and check the JetBrains advisory for any steps for your setup.
What's affected
- Product: JetBrains TeamCity, the CI and CD server
- Affected: versions before 2024.12.2 per the record
- Fixed: 2024.12.2 (the record's boundary, so the first fixed version is that release)
The record is short: improper Kubernetes connection settings could expose sensitive resources. It lists CWE-522, insufficiently protected credentials, as the weakness. That points at how connection details for a Kubernetes cluster are stored or shown, but the record does not go further, and the JetBrains page I fetched is a list of fixed issues that did not show detail for this entry in the text I could read. Do not read more into the description than it says.
The vector shows that the attacker needs high privileges, with high attack complexity, and that the scope changes. In plain words, it is not an anonymous attack. It is about someone who already has strong access to the TeamCity server and could reach more than that server.
How to check if you're exposed
Check your server version in the TeamCity web interface. The version is shown in the Administration area and in the page footer. For a self hosted install you can also check the build number on the host.
Then list the Kubernetes connections that your TeamCity server holds. In the Administration area, look at the projects that define Kubernetes connections or cloud profiles, and note which clusters and which service accounts they use.
If you use TeamCity Cloud, JetBrains operates the server for you, so check the JetBrains page and your account notices to see whether any action is needed on your side.
What to do now
- Upgrade self hosted TeamCity servers to 2024.12.2 or later.
- Review each Kubernetes connection in TeamCity. Give the service account behind it only the permissions the builds need, and prefer short lived credentials.
- Review who holds administrator and project administrator roles in TeamCity. The vector needs high privileges, so fewer administrators means less exposure.
- If you suspect that connection details were visible to someone who should not have had them, rotate the credentials of the cluster accounts.
- Read the JetBrains security page for the entry on this CVE and follow any extra steps it lists.
Why it matters
The listed weakness is CWE-522 (insufficiently protected credentials). CI servers are valuable targets because they hold the keys to many other systems: source code, registries and clusters. A flaw that exposes how they connect to a cluster is a path to those systems.
The score is lower than an unauthenticated flaw, because it needs high privileges and is complex to use. Still, the changed scope in the vector means the impact can go beyond the TeamCity server itself. The record does not say the issue is exploited in attacks, and it is not in the CISA Known Exploited Vulnerabilities catalog.
This is a good moment to audit what your build server can reach. Most teams find service accounts with more access than builds need.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which TeamCity version fixes CVE-2025-26492?
The record says versions before 2024.12.2 are affected, so 2024.12.2 or later. Confirm on the JetBrains security page.
Does the attacker need an account?
The CVSS vector lists high privileges as required, so this is not an anonymous attack, but it can affect resources beyond the server.
Sources
Check your own dependencies with the free in-browser scan.
Last reviewed: 19 October 2026.
