CVE-2024-27198JetBrains TeamCity 2024 authentication bypass, admin access
What broke
TeamCity On-Premises accepted an unauthenticated request that became an administrator session. CVSS 9.8. Published 4 March 2024. Public estimates at the time put a large share of internet-facing instances in the exploited set. CISA added it to KEV. Cloud was not affected.
Why it matters
CI is an identity plane: cloud keys, signing certs, deployment tokens. TeamCity's 2023 bypass (CVE-2023-42793) was already a nation-state and ransomware favorite. The 2024 ID is the same product failing the same test. Our July 2026 TeamCity note (CVE-2026-63077) exists because this pattern did not stop.
What to do
- Patch to the March 2024 TeamCity build. If the server was public in early March 2024, rotate every credential the build system could reach.
- Review newly created admin users and SSH keys on agents.
- Do not put TeamCity on the internet. Agent traffic can stay internal.
After you patch
A build system holds the credentials to ship your software, so an unauthenticated bypass here is a software supply chain event rather than one compromised host.
- Rotate every secret the server held: signing keys, registry and cloud credentials, deploy tokens, and any service account it authenticated as.
- Review build history for injected steps during the exposure window, and compare published artifacts against expected hashes.
- Revoke sessions and administrative tokens rather than only resetting passwords.
- Check for accounts and API tokens created during the window, which is the standard persistence step after this class of bypass.
Sources
- NVD: CVE-2024-27198
- CISA KEV
- JetBrains TeamCity advisory, March 2024
Related identity CVEs
Related on Start with Identity
- CVETeamCity agent-polling protocol authentication bypass to RCE
Every on-premises TeamCity version was vulnerable. An unauthenticated attacker abuses the agent polling channel and runs OS commands as the server. Fixed 27 Jul
- CVECheck Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
Check Point Security Gateway and Spark firewalls mishandled certificate data during VPN negotiation, giving unauthenticated code execution. Patched September 9,
- CVECisco ISE API authentication bypass, exploited on the network access control plane
An API endpoint on Cisco Identity Services Engine skipped authentication, letting an unauthenticated attacker past the admin interface and, per Cisco, to root.
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a