JetBrains Breached Through Its Own Unpatched TeamCity: AWS Keys and Code Leaked

JetBrains is investigating an incident in which unknown attackers broke into its own environment by exploiting a critical vulnerability in TeamCity. The victim was the cloud service Cadence — a platform for running machine learning tasks and heavy computations on cloud GPUs directly from the PyCharm IDE via an optional plugin.

The company strongly recommends that all Cadence users immediately revoke or rotate all credentials and secrets that may have been used while running tasks, and treat the runs themselves, along with their input and output data, as potentially compromised.

How It Happened

The vector was CVE-2026-63077 (CVSS 9.8) — deserialization of untrusted data, allowing an unauthenticated attacker to bypass access checks and execute arbitrary commands with the privileges of the TeamCity process. CISA added it to its catalog of actively exploited vulnerabilities on August 5, 2026. JetBrains discovered the exploitation on August 23; by its estimate, the intrusion lasted from August 8 to August 24.

A particularly awkward detail: the compromised server api.cadence.jetbrains.com was supposed to have been patched as part of the company's own vulnerability remediation program. JetBrains declined to explain why that did not happen. The server has since been taken offline.

What Leaked

The attackers gained access to a 2024 backup of the Cadence server, which contained credentials, configurations, artifacts and logs. Access to personal data (names, e-mail addresses, last login times and IP addresses) has been confirmed, as well as access to several AWS IAM users and their keys — including the accounts of JetBrains employees who used the service. Also at risk are files in S3 buckets and the source code of projects synced from PyCharm: when uploading files to run in the cloud, users could have inadvertently exposed code, keys and configurations.

According to JetBrains, this involves the same group of users the company had already contacted earlier; no new victims were identified.

What to Do

Besides rotating all secrets, users are advised to check related systems — AWS accounts, S3 buckets, deployment environments, package and container registries — for suspicious activity, to audit repositories for unauthorized changes, and to watch for signs of compromise starting from August 8. JetBrains has published a list of IP addresses associated with the attack and has already revoked all access tokens for the Cadence plugin in PyCharm.

The company warns that the leak of personal data increases the risk of targeted phishing, social engineering and attempts to impersonate victims using their names and addresses.

Source: The Hacker News