JetBrains Cadence Breach: Critical TeamCity Flaw Exposes User Credentials and AWS Secrets

JetBrains, a leading software development company, has issued an urgent alert to its Cadence users, advising them to immediately revoke and rotate all credentials and secrets. The directive comes in the wake of a significant security incident last month, where unidentified threat actors exploited a critical, unpatched vulnerability in JetBrains’ own TeamCity environment to compromise its Cadence cloud computing service.

Unpatched Vulnerability Paves Way for Breach

The attackers leveraged a severe deserialization of untrusted data vulnerability, identified as CVE-2026-63077, which carries a critical CVSS score of 9.8. This flaw allowed an unauthenticated attacker with access to a TeamCity server to bypass authentication mechanisms and execute arbitrary operating system commands with the elevated privileges of the TeamCity server process. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) recognized the severity, adding this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on August 5, 2026, indicating active exploitation in the wild.

JetBrains discovered the exploitation within its systems on August 23, 2026. The intrusion window is believed to have spanned from August 8 to August 24, 2026, during which the compromised Cadence server (api.cadence.jetbrains.com) was actively exploited before being taken offline.

What Was Compromised?

The breach granted threat actors unauthorized access to a wealth of sensitive information. JetBrains confirmed that the attackers accessed data from a Cadence server backup dating back to 2024. This access potentially exposed current Cadence user data, including:

• Personal User Data:

  Usernames, real names, email addresses, last-login timestamps, and last accessed IP addresses.

• Cadence Server Backup:

  A full 2024 backup containing credentials, configuration details, artifacts, logs, and other critical data.

• AWS Credentials:

  Multiple AWS IAM users and associated credentials/secrets used with Cadence, extracted from the 2024 backup. This includes credentials belonging to JetBrains employees who utilized the service.

• S3 Bucket Files:

  Files stored in S3 buckets within JetBrains’ AWS accounts that were used by Cadence.

Furthermore, JetBrains cautioned that source code synchronized from PyCharm projects to the affected Cadence server might also have been accessed. This is particularly concerning for developers who relied on PyCharm to upload or synchronize project files for execution in Cadence, as their code, credentials, or configurations could have been inadvertently exposed.

Urgent Action Required for Cadence Users

“Cadence users should immediately revoke or rotate all credentials and secrets that may have been used to run their Cadence executions,” JetBrains stated, emphasizing the urgency. Users are also advised to treat all executions, including their inputs and outputs, within their Cadence projects as potentially untrusted. Daniel Gallo, Solutions Engineering Lead at JetBrains, confirmed that while no new affected users were identified beyond those previously contacted, the company is treating all stored data as potentially exposed as a precaution.

In response to the incident, JetBrains has invalidated all access tokens used by the JetBrains Cadence plugin in PyCharm to connect to Cadence.

Indicators of Compromise (IOCs) and Remediation Steps

To aid users in identifying potential unauthorized activity, JetBrains has provided a list of Indicators of Compromise (IOCs):

• Activity from August 8, 2026, onwards, particularly authentication or activity using credentials previously stored in or accessible through Cadence.
• Observed exploitation activity from specific IP addresses: 150.109.230.104, 43.153.227.206, 62.210.127.48, 210.247.242.190, 15.235.225.205, 152.233.30.18.
• Authentication or other activity from unexpected IP addresses or locations.
• Unexpected repository clones or downloads, and unexpected commits to repositories.
• Changes to repository secrets, webhooks, collaborators, or permissions.
• New or modified personal access tokens, API tokens, or SSH keys in external services.
• New service accounts created in external services.
• Unexpected changes to cloud IAM roles, policies, or permissions.

• Unexpected access to cloud storage, including S3 buckets and objects, in services such as AWS and Google Cloud.

• Unexpected publication or modification of packages or releases.

Beyond rotating all credentials, users are strongly urged to review all connected systems for suspicious activity. This includes AWS accounts, S3 buckets, deployment environments, package/container registries, and any other systems accessible using the now-revoked credentials. The incident serves as a stark reminder of the critical importance of timely patching and robust security practices in cloud development environments.

For more details, visit our website.

Source: Link