{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T18:54:42.548Z",
  "tag": {
    "id": "ci-cd",
    "label": "CI/CD",
    "isStack": false,
    "url": "https://pwn.watch/t/ci-cd",
    "feed": "https://pwn.watch/t/ci-cd/feed.xml"
  },
  "counts": {
    "incidents": 4,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 4
  },
  "incidents": [
    {
      "slug": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199",
      "title": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199",
      "json": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "JetBrains TeamCity",
      "tags": [
        "devtools",
        "java",
        "jetbrains",
        "teamcity",
        "auth-bypass",
        "ci-cd",
        "cisa-kev",
        "ransomware"
      ],
      "cveIds": [
        "CVE-2024-27198",
        "CVE-2024-27199"
      ],
      "affectedVersions": [
        "TeamCity On-Premises before 2023.11.4 (JetBrains)"
      ],
      "fixedVersions": [
        "2023.11.4 (JetBrains)"
      ],
      "startedAt": "2024-03-04",
      "closedAt": "2024-03-07",
      "updatedAt": "2024-03-07",
      "summary": "JetBrains TeamCity contains an authentication bypass vulnerability that allows an attacker to perform admin actions. Added to the CISA KEV catalog on 2024-03-07. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "jenkins-cli-arbitrary-file-read-cve-2024-23897",
      "title": "Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE",
      "url": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897",
      "json": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Jenkins Command Line Interface (CLI)",
      "tags": [
        "devtools",
        "java",
        "jenkins",
        "ci-cd",
        "cisa-kev",
        "ransomware",
        "rce"
      ],
      "cveIds": [
        "CVE-2024-23897"
      ],
      "affectedVersions": [
        "Jenkins 2.441 and earlier, LTS 2.426.2 and earlier (Jenkins advisory)"
      ],
      "fixedVersions": [
        "Jenkins 2.442",
        "LTS 2.426.3",
        "LTS 2.440.1"
      ],
      "startedAt": "2024-01-24",
      "closedAt": "2024-08-19",
      "updatedAt": "2024-08-19",
      "summary": "Jenkins Command Line Interface (CLI) contains a path traversal vulnerability that allows attackers limited read access to certain files, which can lead to code execution. Added to the CISA KEV catalog on 2024-08-19. CISA lists known use in ransomware campaigns.",
      "xPost": null
    },
    {
      "slug": "jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "title": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "json": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "JetBrains TeamCity On-Premises",
      "tags": [
        "devtools",
        "jetbrains",
        "teamcity",
        "ci-cd",
        "auth-bypass",
        "rce",
        "north-korea",
        "apt29",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2023-42793"
      ],
      "affectedVersions": [
        "Before 2023.05.4 (NVD)"
      ],
      "fixedVersions": [
        "2023.05.4"
      ],
      "startedAt": "2023-09-18",
      "closedAt": "2023-12-13",
      "updatedAt": "2023-12-13",
      "summary": "An authentication bypass in JetBrains TeamCity On-Premises gave unauthenticated attackers remote code execution on the CI server. Microsoft saw two North Korean groups exploit it, and US and allied agencies later said Russia's SVR (APT29) mass-exploited it. That's a direct path into build pipelines.",
      "xPost": null
    },
    {
      "slug": "circleci-security-incident-rotate-all-secrets-2023",
      "title": "CircleCI breach: rotate every secret",
      "url": "https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023",
      "json": "https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "no-fix-needed",
      "product": "CircleCI",
      "tags": [
        "devtools",
        "circleci",
        "ci-cd",
        "secrets",
        "infostealer",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-01-04",
      "closedAt": "2023-01-13",
      "updatedAt": "2023-01-13",
      "summary": "Malware on a CircleCI engineer's laptop stole a 2FA-backed SSO session. The attacker then exfiltrated customer environment variables, tokens and keys along with the encryption keys, so CircleCI told every customer to rotate all secrets stored in the platform.",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "jenkins-cli-arbitrary-file-read-cve-2024-23897",
      "incidentTitle": "Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-08-19",
      "title": "CISA added CVE-2024-23897 to the KEV catalog (federal deadline 2024-09-09)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199",
      "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-07",
      "title": "CISA added CVE-2024-27198 to the KEV catalog (federal deadline 2024-03-28)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199",
      "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-04",
      "title": "CVE-2024-27198 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-27198",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199",
      "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-04",
      "title": "CVE-2024-27199 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-27199",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2024-27198-27199",
      "incidentTitle": "JetBrains TeamCity on-prem auth bypass (CVE-2024-27198) exploited",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-03-04",
      "title": "JetBrains releases TeamCity 2023.11.4; Rapid7 publishes details of both auth bypasses",
      "body": null,
      "sourceUrl": "https://blog.jetbrains.com/teamcity/2024/03/additional-critical-security-issues-affecting-teamcity-on-premises-cve-2024-27198-and-cve-2024-27199-update-to-2023-11-4-now/",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2024-27198-27199"
    },
    {
      "incident": "jenkins-cli-arbitrary-file-read-cve-2024-23897",
      "incidentTitle": "Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-24",
      "title": "CVE-2024-23897 published",
      "body": null,
      "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-23897",
      "url": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897"
    },
    {
      "incident": "jenkins-cli-arbitrary-file-read-cve-2024-23897",
      "incidentTitle": "Jenkins CLI arbitrary file read (CVE-2024-23897) leads to RCE",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-01-24",
      "title": "Jenkins security advisory and fixed releases",
      "body": null,
      "sourceUrl": "https://www.jenkins.io/security/advisory/2024-01-24/",
      "url": "https://pwn.watch/i/jenkins-cli-arbitrary-file-read-cve-2024-23897"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-12-13",
      "title": "CISA, FBI, NSA and partners: Russia's SVR exploiting TeamCity at scale (AA23-347A)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-347a",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-18",
      "title": "Microsoft: North Korean actors Diamond Sleet and Onyx Sleet are exploiting it",
      "body": null,
      "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2023/10/18/multiple-north-korean-threat-actors-exploiting-the-teamcity-cve-2023-42793-vulnerability/",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-10-04",
      "title": "CISA adds CVE-2023-42793 to the KEV catalog",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793"
    },
    {
      "incident": "jetbrains-teamcity-auth-bypass-cve-2023-42793",
      "incidentTitle": "TeamCity On-Premises auth bypass to RCE, exploited by North Korea and Russia (CVE-2023-42793)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-09-18",
      "title": "JetBrains releases TeamCity 2023.05.4 and a security patch plugin",
      "body": null,
      "sourceUrl": "https://blog.jetbrains.com/teamcity/2023/09/critical-security-issue-affecting-teamcity-on-premises-update-to-2023-05-4-now/",
      "url": "https://pwn.watch/i/jetbrains-teamcity-auth-bypass-cve-2023-42793"
    },
    {
      "incident": "circleci-security-incident-rotate-all-secrets-2023",
      "incidentTitle": "CircleCI breach: rotate every secret",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-01-13",
      "title": "Incident report: malware stole an engineer's SSO session in December 2022; customer data and encryption keys were exfiltrated",
      "body": null,
      "sourceUrl": "https://circleci.com/blog/jan-4-2023-incident-report/",
      "url": "https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023"
    },
    {
      "incident": "circleci-security-incident-rotate-all-secrets-2023",
      "incidentTitle": "CircleCI breach: rotate every secret",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-01-04",
      "title": "CircleCI tells all customers to rotate every secret stored in CircleCI",
      "body": null,
      "sourceUrl": "https://circleci.com/blog/january-4-2023-security-alert/",
      "url": "https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023"
    }
  ]
}