JetBrains TeamCity exposes sensitive data through default agent parameters. The flaw allows an attacker who can read these default settings to obtain confidential information such as authentication secrets or project credentials. As a result, confidentiality is compromised, enabling further malicious activity against projects managed by the affected TeamCity instance. The weakness is classified as CWE-526, which relates to the improper handling of sensitive data.

JetBrains TeamCity installations running any version released prior to 2025.11.2 are affected. The issue is inherent to the default agent configuration shipped with those releases.

The CVSS score of 4.3 categorizes this vulnerability as medium severity, emphasizing that mitigating it is advisable but not a critical emergency. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be the exposure of agent parameters within the TeamCity configuration, which may be accessed by users with sufficient permissions or by anyone who can read the agent configuration files or API responses. The risk is primarily the accidental disclosure of confidential credentials rather than criminal exploitation, so the likelihood of active compromise is moderate and largely contingent on the internal security posture of the deployment.