CVE-2026-106219 is a medium severity flaw (CVSS 6.5) in JetBrains TeamCity. Missing validation of Git submodule URLs allowed reading local repositories on the server. The record says versions before 2026.2.1 are affected, so upgrade to TeamCity 2026.2.1 or later.
What's affected
The record lists TeamCity before 2026.2.1. The vendor's fixed security issues page is where JetBrains lists such fixes. When we fetched it, the page did not return readable text, so we could not confirm details beyond the record. Check the JetBrains page for the entry and for any notes on build numbers, mitigations or backports.
The weakness is CWE-73, external control of a file name or path. The CVSS vector in the record is network reachable, low complexity, with low privileges required, no user interaction, and a high confidentiality impact with no integrity or availability impact. In plain terms: someone who can already do something with the server, such as configuring a build, may be able to read data they should not.
The record does not mention any exploitation, does not flag the CVE as known exploited, and gives no proof of concept detail. We have not added any.
How to check if you're exposed
Check your TeamCity version in the web UI footer or under Administration, then compare it with 2026.2.1. For a server that is managed through containers, check the image tag that is deployed instead of what you remember installing.
Next, think about who can create or edit build configurations and VCS roots on your server. Git submodules are referenced from repository content, so anyone who can point TeamCity at a repository can influence which submodule URLs it is asked to follow. If that group is small and trusted, your exposure is lower. If external contributors or many teams can add VCS roots, treat the fix as more urgent.
Also list which local repositories and mirrors sit on the build server, since those are what the record says can be read. Source mirrors may hold private code or credentials in history.
What to do now
- Upgrade TeamCity to 2026.2.1 or later, following JetBrains upgrade notes and taking a backup first.
- Read the entry on the JetBrains fixed security issues page and note any extra steps it lists.
- Review who holds permissions to create or change projects and VCS roots, and remove access that is no longer needed.
- Rotate any secret you know is stored in a repository on the build server if you have reason to think it was read.
- Review server logs around VCS operations for submodule URLs that point at local paths you do not recognise.
Why it matters
Git submodules let one repository include another by URL. A build server that fetches repositories on a user's behalf has to decide which URLs are safe to follow. If it accepts a local path, the server will read from its own disk rather than from a remote host. According to the record, TeamCity did not validate the submodule URL, so a repository on the server could be read through the submodule mechanism.
This is a quiet kind of bug: no crash, no alert, just data going to someone who should not have it. The score is medium because the attacker needs an account with some privileges and because only confidentiality is affected, but build servers often hold the most sensitive source code a company has. A medium finding on a build server can matter more than a high one on a marketing site.
Quick check
Is this CVE known to be exploited?
The record does not flag it as known exploited, and we found no vendor statement saying so.
Which version fixes it?
The record says TeamCity before 2026.2.1 is affected, so 2026.2.1 is the first fixed version. Confirm in the JetBrains security page.
Sources
You can also run a free in-browser dependency scan at gold.safeguard.sh/scan to see which of your packages carry known CVEs.
Last reviewed: 18 October 2026.
