TeamCity has plugins rather than marketplace actions, and JetBrains warns that plugins can potentially access all information on the server, including secrets. Pin a plugin by installing a specific ZIP you have reviewed, keep its source available, and treat each update as a reviewed change, not an automatic one.
What is the risk?
JetBrains' security notes say to be careful with third-party plugins: install them only from a trusted source and make sure their source code is available, because plugins can potentially access all information on a TeamCity server, including sensitive information. It also notes that the binaries of agent plugins installed on the server are available to anyone who can access the server URL.
So a plugin is code with server-level reach, loaded into the process that stores your credentials, build history and VCS access. A malicious or compromised plugin release does not need to attack your pipeline. It is already inside it.
How does JetBrains say plugins are installed?
The TeamCity documentation gives three routes.
- From the JetBrains Marketplace. In Administration, Plugins, you browse the repository, pick a plugin, choose Get and Install to your server, then confirm. After installation you select Load from the plugin menu to enable it.
- Through the web UI. Upload a plugin ZIP archive from your own machine on the Plugins page.
- Manually. Copy the ZIP into the plugins folder of the TeamCity data directory. If an earlier version is there, remove it. Loading does not need a server restart, according to the page.
Routes 2 and 3 are your pinning mechanisms. You decide which ZIP file goes in, and nothing changes until you replace it. The Marketplace route is convenient, but it pulls whatever version is offered when you click Get. JetBrains also says TeamCity notifies you in the interface when updates exist, and that you can check for plugin updates under Server Administration, Plugins.
To remove a plugin, delete it on the Plugins page and restart the server when the page offers it, or remove the ZIP from the plugins folder and restart. Verify afterwards that the version no longer appears.
What does pinning mean here?
In TeamCity terms, pinning is a process more than a setting. The documentation we fetched does not describe a version lock option, so the control is administrative:
- Keep an approved list of plugin names and exact versions.
- Store the reviewed ZIP and its checksum in an internal location.
- Install through the upload or manual route from that stored file.
- Only let a small group hold the server administrator role, since that role installs plugins.
Constructed example: a team installs a notification plugin from the Marketplace and moves on. A later update adds a call to an external endpoint and reads build parameters. Nobody reads the changelog, since updates are applied when convenient. With a stored approved ZIP and a review step, the change shows up as a diff before it ever loads.
What should a review look at?
Check where the source lives and who maintains it, what the plugin reads (parameters, VCS credentials, agent output), whether it makes outbound network calls, and what changed between the approved version and the new one. If the source code is not available, JetBrains' own advice is to avoid it.
How does this connect to secrets?
JetBrains advises storing secure data in parameters of the password type and disabling super user access when logs are published elsewhere. Neither helps if a plugin can read them, so keep the plugin list short and keep high-value credentials, such as deployment keys, on agents and projects that do not need the plugin.
What to do
- Export the list of installed plugins and versions from the Plugins page.
- Remove any you cannot name an owner and a reason for.
- For each remaining plugin, confirm the source is available and record its location.
- Store the approved ZIP and checksum in your internal artifact store.
- Install future versions from that file, by upload or the plugins folder, after review.
- Restrict the administrator role to a short named list.
- Review the plugin list each quarter and after every TeamCity upgrade.
- Keep TeamCity current. JetBrains downloads critical security updates automatically, but an administrator must approve their installation.
Safeguard SBOM and dependency scanning can inventory the libraries inside plugin ZIPs you build or host yourself, and policy gates can hold changes to the approved list.
Quick check
Does TeamCity have a built-in version lock for plugins?
The documentation we fetched describes no such setting. Pin by installing a reviewed ZIP yourself and replacing it only after review.
Is the Marketplace route unsafe?
Not by itself. JetBrains advises trusted sources with available source code, and the review step still applies to every new version.
Sources
- Installing Additional Plugins, TeamCity documentation, fetched 18 October 2026
- Security Notes, TeamCity documentation, fetched 18 October 2026
Last reviewed: 18 October 2026.
