CVE-2026-100254

Summary

This flaw allows authenticated users to execute commands on Windows servers through CRLF injection in Pipeline Git connection settings, posing a significant risk due to remote code execution capabilities.

Exploitability

Exploitation is moderately difficult as it requires authentication and specific input manipulation, but once achieved, it can lead to full server compromise.

Blast radius

If exploited, the impact is high, as it can lead to complete server control and potential data exfiltration or destruction.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to TeamCity 2026.2 or later.

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.