Following the October 2026 discovery of a security vulnerability regarding weak private keys for eight intermediate Certificate Authorities (Intermediate CAs) belonging to eMudhra, JetBrains has issued urgent technical guidelines for TeamCity platform users to ensure the security of their development and operational environments.
What Happened?
It was determined that the private keys for eight CAs belonging to eMudhra were weak and recoverable from public data. Although eMudhra confirmed there is no evidence of exploitation prior to disclosure, the danger lies in the fact that software components relying on trust stores—such as the Java runtime environment—may continue to trust certificates issued by these compromised authorities.
What Changes Practically for Users?
JetBrains emphasizes that the vulnerability is not within the TeamCity platform itself, but rather affects the infrastructure it relies upon. Therefore, DevOps teams must take the following steps:
- Update the Java Runtime Environment (JRE): Java environments used in TeamCity servers and build agents must be updated to versions that address CVE-2026-91403 and CVE-2026-114820.
- Update TeamCity: Upgrading to versions 2026.2.2 or 2026.1.6 is recommended, as they include health reports that automatically detect the presence of affected certificates in the system.
- Review Uploaded Certificates: Updating Java does not remove certificates manually uploaded by users to TeamCity; therefore, they must be inspected and any affected certificates removed via the certificate management interface in the root project.
- Update CLI Tools: The TeamCity CLI must be updated to version 1.6.1 or later, as it has been rebuilt using a Go version that includes the necessary security fixes.
Why This News Matters?
This incident serves as a reminder of the importance of managing trust chains in CI/CD environments. Since TeamCity acts as a hub for development operations, any vulnerability in trusted certificates could open the door to impersonation attacks or data interception. The updates provided by JetBrains are not merely software improvements, but necessary preventive measures to prevent the exploitation of weak certificates in production environments.
System administrators must also review supporting infrastructure, including operating systems, build tools such as Git and Python, and containers (Docker), to ensure they do not rely on trust stores containing the compromised certificates.