CVE-2026-106219: CWE-73 in JetBrains TeamCity

This vulnerability (CVE-2026-106219) in JetBrains TeamCity arises from improper validation of Git submodule URLs. Specifically, before version 2026.2.1, TeamCity does not properly validate these URLs, enabling a user with some privileges (low complexity, no user interaction required) to read local repositories on the server. The CVSS 3.1 vector indicates network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact without integrity or availability impact.

An attacker with low privileges can exploit this vulnerability to read sensitive data from local Git repositories on the TeamCity server. This can lead to unauthorized disclosure of potentially sensitive source code or configuration data. There is no impact on integrity or availability reported. No known exploits are currently active in the wild.

A fix is available in JetBrains TeamCity version 2026.2.1. Users should upgrade to version 2026.2.1 or later to remediate this vulnerability. Since this is not a cloud service, remediation depends on user action to apply the update. Patch status is confirmed by the affectedVersions field indicating the fix in 2026.2.1.