The vulnerability is an unauthenticated Server Side Request Forgery that can be triggered via the build status endpoint in JetBrains TeamCity versions prior to 2026.1, including 2025.11.5. Because the endpoint does not require authentication, an attacker can instruct a TeamCity server to send arbitrary HTTP requests to internal or external URLs. The resulting SSRF can expose internal network resources or create a pivot point for further attacks. The weakness corresponds to CWE‑918.

JetBrains TeamCity installations running any version before 2026.1, notably the 2025.11.5 release, are affected. Users running earlier builds without the 2026.1 update lack protection against the SSRF via build status endpoint.

The CVSS score of 7.5 indicates a moderate to high severity vulnerability. No EPSS score is available, and it is not listed in the CISA KEV catalog, suggesting that the exact exploitation frequency is unclear. The SSRF can be leveraged by an attacker who can reach the build status URL, potentially from the public Internet, since no authentication is required. Consequently, the attack vector is remote over the network, and the risk is significant for any publicly exposed TeamCity server. Mitigating this issue requires an application update or network restrictions.