CVE-2026-106218 RCE in TeamCity via Kotlin DSL Sandbox Escape

CVE-2026-106218 describes a sandbox escape defect in the Kotlin DSL engine of JetBrains TeamCity. Kotlin DSL is the language used to define continuous integration and deployment pipelines in TeamCity. An authenticated user or entity able to send requests to the TeamCity server could exploit this flaw to execute arbitrary code with application server privileges.

The vulnerability has a CVSS score of 8.8 (HIGH), indicating significant risk for production environments. JetBrains confirmed the issue and released patches on 2026-10-06 through the NVD database. No public exploits are reported on GitHub repositories. However, the vulnerability has already been mentioned on specialized social media, a signal that security awareness in the cybersecurity sector is active.

Recommended actions for infrastructure teams: 1) Immediately verify the versions of TeamCity in production; 2) If the version is below 2026.1.3 or 2025.11.7, schedule patching with critical priority; 3) In the short term, evaluate access restrictions to the TeamCity server (firewall, VPN) to limit exposure; 4) Monitor TeamCity logs for anomalous activity or unexpected access to the Kotlin DSL.

The Kotlin DSL in TeamCity is a sensitive attack surface because it processes declarative code submitted by users. If the sandbox is not sufficiently robust, an escape can lead to system command execution. This is particularly critical in environments where TeamCity manages builds of sensitive or controlled software.