Detecting and Hunting CVE-2026-106218 Exploitation in TeamCity Environments

Why detection is the hard part

CVE-2026-106218 is a sandbox escape in the TeamCity Kotlin DSL integration, scored 8.8, that permits arbitrary code execution on the build host. There is no confirmed exploitation in the wild and no public proof-of-concept, so defenders are working ahead of observed attacks rather than behind them. That is a sensible moment to build hunts, because the signals are still readable.

Start with the configuration surface

The escape requires influence over Kotlin DSL configuration content. Enumerate the repositories that feed build configuration, then look at their history over the exposure window:

• commits to build-configuration files from accounts that rarely touch them
• changes that add shell invocations, network fetches or file writes
• merges that bypass the normal review path
• configuration edited directly in the TeamCity user interface rather than through version control

Host-level signals

Because the outcome is code execution on the TeamCity host, the useful telemetry is process-based. Build servers are noisy, which is exactly why a baseline is required. Look for:

• child processes spawned by the TeamCity server process rather than by a build agent worker
• outbound connections from the server host to addresses that are not part of the normal dependency set
• new scheduled tasks, services or startup entries on the build machine
• reads of configuration files that store credentials

Artefact-level signals

Tampering shows up in output. Compare artefact hashes for builds produced during the exposure window against a rebuild from a pinned source revision. Investigate discrepancies even when the pipeline reported success.

Affected versions and the patch line

The fix is available in TeamCity 2026.1.3 and 2025.11.7. Related flaws in the same advisory batch affect the Exposed library before 1.5.1 and a submodule URL handling issue fixed in 2026.2.1. No installation count has been published.

Exposure context

A fingerprint query for the TeamCity application returns 1,868 instances globally. A query on the CVE identifier returns no results yet. The product count is the more useful starting point for an external attack-surface review, and it says nothing about which of those systems are patched.

Practical hunt order

Patch first, then hunt, because a patched system still holds the evidence. Investigate configuration history, then host process trees, then artefact integrity, and finally credential rotation for anything the build host could reach. If nothing is found, the honest conclusion is that no evidence was found, not that no compromise occurred.

References

• SecurityOnline vulnerability report: https://securityonline.info/jetbrains-software-vulnerabilities-teamcity/