TeamCity Vulnerability Breached JetBrains Cadence

JetBrains has confirmed that its Cadence service was breached through a TeamCity vulnerability on a server that should have been patched. It is a textbook reminder that your CI/CD pipeline is production, and its secrets are the keys to everything downstream of it.

The TeamCity vulnerability behind the breach

According to JetBrains’ own investigation, attackers exploited CVE-2026-63077 against an unpatched TeamCity instance that had been flagged for update but never got it. From there the access reached a 2024 backup, AWS IAM users, files stored in S3, and potentially source code and user credentials. JetBrains urged customers to rotate authentication tokens and secrets.

The detail that stings is not the JetBrains TeamCity vulnerability itself; it is that the server was known to need patching and slipped through anyway. That gap between ‘we know about this’ and ‘we fixed this’ is where most real breaches live.

Why CI/CD is the highest-value target you under-protect

A build server is not a support tool; it is one of the most powerful machines you own. To do its job, TeamCity holds the crown jewels in one place:

• Cloud credentials: AWS IAM keys and roles that can reach production, storage and more.
• Source code: your intellectual property and, worse, a map of every other weakness.
• Signing keys and deploy tokens: the ability to ship code that everything downstream trusts.
• Access to prod: pipelines that push to live systems by design.

Compromise the pipeline and you inherit all of it at once, which is why an unpatched CI box is a supply-chain risk, not just an IT one. Strong TeamCity security is not optional hardening; it is protecting the machine that can deploy to everything. That ground is exactly what our DevSecOps and CI/CD security testing and secrets and credential exposure assessment are built for.

Our take

CI/CD security keeps losing the internal argument because build infrastructure sits in an ownership gap. Security teams treat it as ‘dev’, dev teams treat it as ‘infra’, and everyone assumes someone else patches it. Meanwhile it holds more privilege than most production servers. This breach is the predictable outcome of that gap, and it is common: a known TeamCity CVE, a server that never got the update, an attacker who simply used the front door.

The stored 2024 backup matters too. Old artifacts and backups are a quiet liability, full of credentials that were valid then and often still are now. Rotating secrets is not a one-time reaction to a breach; it is a discipline that limits how much a stolen backup is worth.

What to do right now

• Patch TeamCity and every build tool now, and give CI infrastructure the same patch SLA as production, because it is production.
• Rotate every secret your pipeline can reach: tokens, signing keys, cloud credentials. Assume anything the build server touched is exposed.
• Scope IAM down hard. A build role should have the minimum it needs, never broad standing access to production and storage.
• Review who and what can reach the build system, and map the real exposure with a supply chain security assessment.
• Purge or lock down old backups and artifacts that carry stale credentials.
• If credentials or data were exposed, our data breach response team runs containment, forensics and any required notifications.

The bigger picture

Attackers stopped bothering to breach the fortress when they can compromise the factory that builds it. Software supply-chain attacks work because CI/CD concentrates enormous privilege in systems that were never hardened like the crown jewels they are. Treat your pipeline as production, patch it like production, and test it like production, or accept that one missed update can hand over everything it can deploy to.

We track offensive-security research closely, and for readers who want to go deeper on technique we recommend the penetration testing section at SecurityLab alongside our own write-ups.

Secure your pipeline