Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials

JetBrains' Own CI/CD Server Went Unpatched

JetBrains has confirmed that its Cadence cloud development service — which lets developers run PyCharm-plugin-driven projects on cloud compute — was compromised after attackers exploited a critical, already-known vulnerability in TeamCity, the CI/CD server JetBrains uses to manage Cadence's cloud workloads. The irony wasn't lost on observers: JetBrains has spent months urging its own customers to patch TeamCity, while running an unpatched instance internally.

The Vulnerability

The attackers exploited CVE-2026-63077 (CVSS 9.8), an authentication-bypass flaw in TeamCity's agent polling protocol. It allows an unauthenticated attacker with HTTP access to the server to run arbitrary OS commands with the privileges of the TeamCity server process. The flaw was already under active exploitation in the wild before this incident, and CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on August 5, 2026.

Timeline

The api.cadence.jetbrains.com host ran unpatched for the TeamCity flaw for at least two and a half weeks after it was added to KEV — and for over two weeks of active attacker presence before discovery.

What Was Exposed

Attackers accessed and stole personal data belonging to Cadence users, and gained control of a full server backup dated 2024. That backup contained sensitive AWS IAM credentials and configuration data. JetBrains has separately confirmed compromise of several AWS IAM users and attacker access to files stored in its AWS S3 buckets, and says it is still investigating whether customer storage buckets were also accessed.

JetBrains warns that Cadence user data, source code, credentials, configuration, artifacts, logs, and execution outputs may have been exposed or affected.

JetBrains' Response

JetBrains has invalidated all access tokens for the PyCharm Cadence plugin and issued direct guidance to affected customers:

"Cadence users should immediately revoke or rotate all credentials and secrets that may have been used to run their Cadence executions."

The company is advising customers to treat all Cadence executions — including both inputs and outputs — as potentially untrusted, on the basis that any credentials or secrets referenced in Cadence or present in the compromised 2024 backup should now be considered compromised.

Why This Matters

This is a textbook illustration of supply-chain risk from your own tooling: a vendor that builds developer infrastructure was breached through the exact class of vulnerability — an unpatched, KEV-listed CI/CD server flaw — that security teams are routinely told to prioritize. For Cadence users, the blast radius extends well beyond JetBrains' own environment, since AWS credentials used inside Cadence executions may now be in attacker hands.

Recommended Actions

1. If you use JetBrains Cadence, immediately rotate every credential and secret that was ever used in a Cadence execution — AWS keys, GitHub tokens, container registry credentials, and any other API keys.
2. Treat all Cadence execution history as untrusted. Review inputs and outputs for the period around August 8–24, 2026 for signs of tampering or exfiltration.
3. Audit connected AWS environments for unauthorized IAM users, unexpected policy changes, or unfamiliar S3 access patterns tied to credentials that touched Cadence.
4. Check for unauthorized code changes or new service accounts in any environment connected to a Cadence project.
5. Prioritize KEV-listed vulnerabilities on your own CI/CD infrastructure — this incident shows the gap between "patch is available" and "patch is applied" can be exploited within days, even by sophisticated vendors.

Sources

• The Hacker News — Attackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS Credentials