CVE-2026-100255 is an administrator account takeover flaw in JetBrains TeamCity, reachable through the password reset flow. NVD scores it 8.1, high severity. Per the record, fixed builds are 2026.2, 2026.1.4 and 2025.11.8, depending on your release line, so upgrade to the one for yours.
What's affected
The CVE record says: "In JetBrains TeamCity before 2026.2, 2026.1.4, 2025.11.8 administrator account takeover was possible via password reset."
- Product: JetBrains TeamCity, the CI/CD server.
- Affected: builds before 2026.2, before 2026.1.4 and before 2025.11.8, which reads as one fixed build per release line.
- Fixed: 2026.2, 2026.1.4 and 2025.11.8 respectively.
- Severity: CVSS 8.1, vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. No login is needed and attack complexity is high. - Exploitation: neither the record nor any source I could read says it is exploited. It is not on the CISA KEV list.
JetBrains publishes the details on its Fixed security issues page. When I tried to read that page it loaded as a script-driven shell with no advisory text, so this post relies on the CVE record for versions and descriptions. Confirm against the page before you act on a version number.
How to check if you're exposed
Find the TeamCity version in the web interface; it is shown in the page footer and in the administration area. For a container or package install, check the image tag or package version instead.
# Docker, example
docker ps --format "table {{.Names}}\t{{.Image}}"
Compare it with the three fixed builds above, using the one that matches your release line.
Then consider reachability. The flaw is in password reset, which means the login page and the mail flow are involved. If your server is reachable from the internet, or from a network where you do not trust everyone, exposure is higher. If it is only reachable from a VPN, lower.
Finally, check for signs of misuse. Look at the audit log for password changes and for administrator logins you do not recognise, and check your mail logs for reset messages that nobody asked for.
What to do now
- Identify every TeamCity server, including old test instances, and record the version and release line.
- Upgrade to 2026.2, 2026.1.4 or 2025.11.8, whichever matches your line, following JetBrains instructions for your install type.
- Review administrator accounts. Remove any you do not recognise and reset passwords for those that remain.
- Review the audit log for password resets and administrator logins in the weeks before you patched.
- If a takeover is possible, assume the build secrets are exposed: rotate tokens, SSH keys and cloud credentials stored in TeamCity.
Why it matters
The weakness is recorded as CWE-1289 (improper validation of unsafe equivalence in input). The record does not describe the mechanism beyond saying it concerns password reset. Account recovery code is a frequent source of takeover bugs because it must decide that a person is who they claim without a password, and small mistakes in how identities are compared can let one identity pass as another.
The reason this one deserves speed is what an administrator can do on a CI server. TeamCity builds software and holds the secrets needed to deploy it: repository tokens, signing keys, cloud credentials. An attacker who becomes an administrator can change build steps and add their own, so the harm can reach every product the server builds and everyone who uses it. That is a supply chain risk, not only a server risk.
The CVSS vector rates attack complexity as high, so it is not trivial. It still needs no login and no user action, so patch on a normal but short schedule and treat a CI server like production.
Try it yourself
New advisories for tools like CI servers often appear on a vendor page before they reach most scanners. This demo shows a watch view that tracks fresh disclosures against the software you run.
Click through it at your own pace, or open it full screen.
Quick check
Which TeamCity builds fix CVE-2026-100255?
The record says versions before 2026.2, 2026.1.4 and 2025.11.8 are affected, so those three builds fix it on their respective release lines. Confirm on the JetBrains page.
Do I need to rotate secrets?
If you find evidence of unauthorised password resets or admin logins, yes. If you find none, patching is the priority, and a precautionary rotation is a judgement call.
Sources
Last reviewed: 19 October 2026.
