CVE-2024-27198JetBrains TeamCity 2024 authentication bypass, admin access
What broke
TeamCity On-Premises accepted an unauthenticated request that became an administrator session. CVSS 9.8. Published 4 March 2024. Public estimates at the time put a large share of internet-facing instances in the exploited set. CISA added it to KEV. Cloud was not affected.
Why it matters
CI is an identity plane: cloud keys, signing certs, deployment tokens. TeamCity's 2023 bypass (CVE-2023-42793) was already a nation-state and ransomware favorite. The 2024 ID is the same product failing the same test. Our July 2026 TeamCity note (CVE-2026-63077) exists because this pattern did not stop.
What to do
- Patch to the March 2024 TeamCity build. If the server was public in early March 2024, rotate every credential the build system could reach.
- Review newly created admin users and SSH keys on agents.
- Do not put TeamCity on the internet. Agent traffic can stay internal.
After you patch
A build system holds the credentials to ship your software, so an unauthenticated bypass here is a software supply chain event rather than one compromised host.
- Rotate every secret the server held: signing keys, registry and cloud credentials, deploy tokens, and any service account it authenticated as.
- Review build history for injected steps during the exposure window, and compare published artifacts against expected hashes.
- Revoke sessions and administrative tokens rather than only resetting passwords.
- Check for accounts and API tokens created during the window, which is the standard persistence step after this class of bypass.
Sources
- NVD: CVE-2024-27198
- CISA KEV
- JetBrains TeamCity advisory, March 2024
Related identity CVEs
Related on Start with Identity
- CVETeamCity agent-polling protocol authentication bypass to RCE
Every on-premises TeamCity version was vulnerable. An unauthenticated attacker abuses the agent polling channel and runs OS commands as the server. Fixed 27 Jul
- CVEConnectWise ScreenConnect auth bypass via an alternate path
ScreenConnect 23.9.7 and earlier skipped authentication on an alternate setup path (CWE-288). Attackers created admin users within hours. CISA KEV. CVSS 10.0. P
- CVEFortiWeb auth bypass and path traversal, admin creation
FortiWeb authentication bypass plus path traversal that lets an attacker create an admin. CVSS 9.8. Added to CISA KEV around 14 November 2025, before the Decemb
- BlogA CVE ID is a name. The value is knowing who the attacker becomes.
We opened a practitioner catalog of identity CVEs: what broke, why IAM teams should care, and what to do this week. Not an NVD mirror. A place to triage SAML wr
- BreachThe 2024 Snowflake customer breaches: stolen credentials meet missing MFA
A campaign against Snowflake customer tenants showed what happens when stolen credentials meet accounts without MFA: dozens of breaches, no platform vulnerabili