JetBrains' own Cadence service fell victim to unpatched TeamCity flaw it publicly disclosed

JetBrains has asked users to rotate credentials and treat all activity from its Cadence cloud development platform as untrustworthy following a breach—ironically, the platform fell prey to a critical vulnerability the company itself had publicly disclosed and urged others to patch.

The flaw, CVE-2026-63077, impacts TeamCity On-Premises and enables remote code execution for anyone with network access to an unpatched server. JetBrains published details on July 27, and confirmed active exploitation by August 7. Yet one server using vulnerable TeamCity software remained exposed: JetBrains' own.

How the breach unfolded#

Attackers compromised api.cadence.jetbrains.com, which powers Cadence, a cloud compute service integrated with PyCharm through an optional plugin. The breach window extended from August 8 to August 24, when JetBrains took the service offline after discovering the intrusion on August 23.

Cadence had orchestrated cloud workloads via a TeamCity instance—placing the compromised system at a critical junction of the development pipeline where developers could sync project files, execute code, and access secrets.

"The server should have been patched as part of our response to the vulnerability, but it was not," JetBrains stated in its disclosure.

The scope of exposed data#

Attackers acquired a complete Cadence server backup from 2024, potentially exposing stored credentials, configuration files, build artifacts, and audit logs. Multiple AWS IAM accounts—including those belonging to JetBrains employees—had their credentials compromised. Files in AWS S3 buckets were accessed, though JetBrains has not yet confirmed whether customer storage was targeted.

Because developers sync project files to Cadence before execution, source code and embedded secrets could have been leaked. The breach also exposed usernames, real names, email addresses, and login metadata.

Supply chain and lateral movement risk#

The incident triggers cascading credential rotation requirements. JetBrains advises revoking or cycling access tokens for AWS, Azure, Google Cloud, GitHub, GitLab, Bitbucket, npm, Maven, NuGet, PyPI, Docker Hub, ECR, GCR, ACR, Slack, SSH, and deployment keys. Any credentials used within Cadence during the affected period should be treated as compromised.

This risk extends beyond access control. Credentials with publishing permissions to package repositories represent a supply chain threat—attackers could inject malicious packages into downstream projects, similar to .