CVE-2026-49371 is a reflected XSS vulnerability in JetBrains TeamCity prior to version 2026.1.1. The issue occurs in the keyword filter functionality, enabling attackers to inject malicious scripts that execute when a user interacts with the affected feature. The vulnerability has a CVSS 3.1 base score of 7.1, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, high confidentiality impact, low integrity impact, and no availability impact. No patch or official remediation level has been disclosed by JetBrains as of the publication date.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the victim's browser, potentially leading to information disclosure or session hijacking. The confidentiality impact is rated high, while integrity impact is low and availability is unaffected. There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should exercise caution when interacting with the keyword filter feature and consider applying any available workarounds or mitigations recommended by JetBrains once published.