CVE-2026-49372

HighCVSS 7.5/10Last modified Jul 22, 2026

Description

In JetBrains TeamCity before 2026.1, 2025.11.5 unauthenticated SSRF via build status was possible

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-918

Affected software

No affected versions have been published.

Timeline

Published
May 29, 2026
Last modified
Jul 22, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-493738.8In JetBrains TeamCity before 2026.1 remote code execution was possible via Perforce connection settingsCVE-2026-493747.6In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parametersCVE-2026-493756.1In JetBrains TeamCity before 2026.1, 2025.11.5 reflected XSS was possible on the repository download pageCVE-2026-493766.5In JetBrains TeamCity before 2026.1 insufficient username validation in the SAML pluginCVE-2026-493774.3In JetBrains TeamCity before 2025.11.2 exposure of sensitive data via default agent parametersCVE-2026-493784.3In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletionCVE-2026-493796.5In JetBrains TeamCity before 2026.1 credentials could be exposed in thread namesCVE-2026-49386.5IBM Verify Identity Access 11.0 through 11.0.2 and IBM Security Verify Access 10.0 through 10.0.9.1 and IBM Verify Identity Access ContainerCVE-2026-493806.1In JetBrains TeamCity before 2026.1 open redirect in the SAML plugin was possibleCVE-2026-493814.8In JetBrains TeamCity before 2026.1 stored XSS on the SAML login page was possibleCVE-2026-493827.8In JetBrains IntelliJ IDEA before 2026.1 code execution was possible via template injection in the Copyright pluginCVE-2026-493833.3In JetBrains IntelliJ IDEA before 2026.1 xXE in the UI Designer form parser was possible
CVE-2026-49372: High severity, CVSS 7.5 | Vulnix