JetBrains TeamCity versions prior to 2025.07.2 contain a vulnerability that allows authenticated attackers to leak credentials, posing a significant risk to environment security.

The vulnerability stems from improper validation of Git URLs (CWE-183), which can be exploited by an authenticated attacker to gain unauthorized access to sensitive credential information on Windows hosts.

Successful exploitation of this flaw can lead to the exposure of sensitive service credentials used within the CI/CD pipeline, potentially granting an attacker access to connected source code repositories or infrastructure environments. Given the CVSS score of 7.7, this is a high-severity issue that could result in lateral movement and severe compromise of the software development lifecycle.

Immediate Action: Update JetBrains TeamCity to version 2025.07.2 or later to resolve the underlying URL validation flaw.

Proactive Monitoring: Review TeamCity server access logs for unusual Git repository configuration requests or unexpected outbound connections from the build server.

Compensating Controls: Restrict access to repository configuration settings to only trusted users and ensure that credentials used by TeamCity are scoped with the principle of least privilege.

Public Exploit Available: False

This vulnerability represents a high risk to the integrity of development pipelines. Administrators should prioritize the update to version 2025.07.2 immediately to prevent credential exposure. Failure to patch may allow attackers to harvest sensitive secrets, leading to broader unauthorized access across the organization.