Attackers Breach JetBrains Cadence via Unpatched TeamCity Vulnerability, Steal AWS Credentials
What Happened — Threat actors exploited a critical, publicly disclosed vulnerability in JetBrains TeamCity that had not been patched. The exploit gave them access to JetBrains Cadence, where they exfiltrated AWS access keys used by Cadence jobs. JetBrains has urged all Cadence users to revoke or rotate any credentials that may have been exposed.
Why It Matters for Trust & Control Assurance
- Demonstrates a gap in third‑party patch management – a control objective that continuous assurance programs must monitor and evidence.
- Credential compromise highlights the need for robust access‑control policies and rapid rotation processes, both essential audit artifacts.
- Provides a real‑world case for documenting vendor‑risk oversight, supporting due‑diligence and defensible audit trails.
Who Is Affected — SaaS and developer‑tool providers that run Cadence or similar workflow engines, and any organization that integrates JetBrains TeamCity into its CI/CD pipeline.
Recommended Actions
- Immediately revoke and rotate all AWS credentials that were used by Cadence jobs.
- Verify that every TeamCity instance is patched to the latest security release; automate patch verification where possible.
- Deploy continuous third‑party risk monitoring to capture patch status and retain evidence for audit readiness.
Technical Notes — The breach leveraged a critical TeamCity vulnerability (CVE‑2026‑XXXX) that allowed remote code execution on the CI server. Attackers used the foothold to access Cadence’s execution environment and extract AWS access keys stored as secrets. Source: The Hacker News