CVE Intelligence
Analysis AI-assisted

CVE-2026-106218: JetBrains TeamCity Kotlin DSL sandbox escape leading to server RCE

A sandbox escape in the Kotlin DSL of JetBrains TeamCity could lead to remote code execution on the server. The record lists affected ranges before 2025.11.7 and from 2026.1.1 up to before 2026.1.3, and NVD rates it critical. No confirmed exploitation in the wild appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

The record describes a sandbox escape in the Kotlin DSL of JetBrains TeamCity. According to the description, the flaw could lead to remote code execution (RCE) on the server. Scores differ by provider: NVD lists a base score of 10, while the JetBrains entry in the record lists 8.8.

Impact

  • Per the description, a successful escape could allow code execution on the TeamCity server.
  • The SSVC data in the record rates technical impact as total.
  • The record does not describe the scope of data or systems that could be reached from the server.

Affected products and versions

  • JetBrains TeamCity before 2025.11.7.
  • JetBrains TeamCity from 2026.1.1 up to before 2026.1.3.
  • The affected field also contains a combined entry tied to 2026.1.3 and 2025.11.7, which suggests two fixed release lines. Confirm the exact boundaries in the vendor advisory.

Exploitation status

  • The record shows the CVE is not listed in the CISA KEV catalog.
  • The SSVC exploitation field is none and automatable is no.
  • The EPSS probability is 0.00281 with a percentile of 0.19512, dated 2026-10-23.
  • No confirmed exploitation in the wild appears in the sources consulted.

Remediation and mitigation

  • Upgrade TeamCity to a fixed release on the 2025.11.7 line or to 2026.1.3 or later, following the vendor advisory.
  • Until patched, limit access to the TeamCity web interface and administrative functions to trusted networks and accounts.
  • Restrict who can edit build configurations and Kotlin DSL scripts, and apply least privilege to service accounts.
  • Confirm the fixed versions in the vendor advisory, since the fixes field in the record is empty.

Detection guidance

  • Review TeamCity audit logs for unexpected changes to Kotlin DSL scripts, build configurations or user permissions.
  • Monitor the TeamCity server for unusual child processes, outbound connections or file changes originating from the service account.
  • Compare the running TeamCity version against the affected ranges to identify exposed instances.

Limitations of the available information

  • The record gives no CWE name and no technical details of the escape, which is intentional for this defensive summary.
  • The fixes field is empty, so fixed versions are taken from the affected ranges and the description.
  • Provider scores disagree (10 at NVD, 8.8 at JetBrains), and the reason is not stated.
  • Whether public exploit code exists is unknown from the record.
  • The impact on specific deployments depends on configuration and is not assessed here.

Frequently asked questions

Which TeamCity versions are affected?

According to the record, versions before 2025.11.7 and from 2026.1.1 up to before 2026.1.3 are affected. Check the vendor advisory to confirm the exact boundaries.

Is this vulnerability being actively exploited?

The record shows it is not in the CISA KEV catalog, and no confirmed exploitation in the wild appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.