This vulnerability (CVE-2026-49372) affects JetBrains TeamCity prior to versions 2026.1 and 2025.11.5. It allows unauthenticated attackers to exploit a Server-Side Request Forgery (SSRF) vulnerability through the build status functionality. SSRF vulnerabilities (CWE-918) occur when an attacker can induce the server to make HTTP requests to arbitrary domains, potentially exposing internal resources or sensitive data. The CVSS 3.1 base score is 7.5, reflecting high severity with network attack vector, low attack complexity, no privileges or user interaction required, and high confidentiality impact but no integrity or availability impact. No patch or official remediation level is currently documented.

An unauthenticated attacker can exploit this SSRF vulnerability to cause the TeamCity server to make arbitrary HTTP requests. This can lead to unauthorized information disclosure from internal or protected network resources accessible by the server. The confidentiality impact is high, but integrity and availability are not affected. No known active exploitation has been reported.

Patch status is not yet confirmed — check the JetBrains advisory for current remediation guidance. Until an official fix is released, restrict network access to the TeamCity server to trusted sources and monitor for unusual outbound requests. Avoid exposing the build status feature to untrusted users if possible.