# JetBrains Got Hacked Through JetBrains: The TeamCity-Cadence Incident Is a Masterclass in Irony and CI/CD Risk
There's a particular kind of embarrassment reserved for security incidents where the victim company makes the exact product that was exploited against them. JetBrains is living through that moment right now.
The company behind TeamCity — one of the most widely deployed CI/CD platforms in enterprise software — confirmed that attackers broke into its own environment last month by exploiting a critical, recently disclosed vulnerability in TeamCity itself. The target was Cadence, JetBrains' workflow execution platform, and what the attackers walked out with were AWS credentials.
JetBrains has issued an urgent advisory: if you run workloads on Cadence, revoke and rotate every secret, credential, and key that those executions could have touched. All of them. Now.
## The Irony Is the Point
JetBrains didn't get breached because of some obscure third-party dependency or a rogue contractor. They got breached through the product they build, maintain, and ship to millions of developers. TeamCity has been a recurring target — it's not a novel attack surface, and the vulnerability class here (authentication bypass or remote code execution in a CI/CD management plane) is well-documented and actively hunted.
What makes this notable isn't the "software company gets hacked" headline. It's what the breach path reveals about how JetBrains was running its own infrastructure relative to its own disclosed patching timeline. The phrase "recently disclosed critical vulnerability" in the company's advisory is doing significant work. Either the patch wasn't applied before the exploitation window closed, or the disclosure-to-patch window was narrow enough that attackers moved faster — which, for TeamCity critical CVEs, they absolutely do.
In 2024, we watched CVE-2024-27198 and CVE-2024-27199 — TeamCity authentication bypass vulnerabilities with CVSS scores in the 9+ range — get mass-exploited within days of disclosure. Nation-state actors and ransomware groups alike ran automated scans and popped vulnerable instances globally. If this incident fits that template, JetBrains got caught in the same stampede they likely warned their own customers about.
## What AWS Credentials Mean in This Context
Let's be specific about why "AWS credentials extracted from Cadence" is a different kind of bad than a generic data exposure.
Cadence is a CI/CD execution environment. By design, it needs access to infrastructure to do its job — pushing artifacts, provisioning environments, running deployments. That means Cadence pipelines routinely hold credentials with real blast radius: IAM roles, access keys, secrets for staging and sometimes production environments. The credential surface isn't incidental — it's structural.
When attackers land in that environment and extract AWS keys, they don't just have a credential. They potentially have:
JetBrains' advisory to rotate "all credentials and secrets that may have been used to run their Cadence executions" acknowledges this blast radius explicitly. The "may have been" qualifier is honest — they likely don't know exactly which secrets the attackers accessed, only that access was possible.
## The CI/CD Pipeline as Attack Surface Isn't a New Warning
Security researchers have been ringing this bell for years. Build systems are the new Active Directory — whoever controls the pipeline controls what ships to production. The 2020 SolarWinds attack proved the concept at scale. Since then, we've seen Codecov, CircleCI, 3CX, and GitHub Actions supply chain compromises that all trace back to the same fundamental problem: CI/CD environments are trusted, high-privilege, and historically under-secured.
TeamCity specifically has been a recurring vector. APT29 — the SVR-linked group behind SolarWinds — was attributed to exploiting TeamCity vulnerabilities in 2023 to target software developers and their downstream customers. CISA issued advisories. The pattern was clear. And yet here we are, a year and a half later, with JetBrains itself on the receiving end.
This isn't a criticism for its own sake. Patching velocity against zero-day and near-zero-day critical vulnerabilities in production CI/CD infrastructure is genuinely hard. Patching often means downtime; CI/CD downtime blocks development; development teams push back. The operational pressure is real. But that pressure is exactly what attackers are counting on.
## What Cadence Users Should Actually Do
JetBrains' guidance to "revoke or rotate all credentials" is correct but underspecified. Here's a sharper breakdown of what this incident demands:
Immediate (hours, not days):
Short-term:
Structural:
## HackWire Analysis
The JetBrains-Cadence incident deserves more scrutiny than the standard "patch your software" response it'll get from most coverage.
The deeper problem exposed here is an industry-wide miscalibration of trust. Organizations extend enormous implicit trust to their CI/CD infrastructure because it's internal, because it's their tooling, because developers run it. But CI/CD pipelines by design are credential aggregators — they touch production secrets, cloud APIs, artifact registries, and deployment targets. If your pipeline is compromised, your security perimeter is already inside-out.
JetBrains making TeamCity and running an unpatched version of it is embarrassing, but it's also a signal about how even the vendors building these tools haven't fully internalized their own threat model. The "cobbler's children have no shoes" dynamic is alive and well.
What concerns me more than this specific incident is the pattern it represents: cloud credentials extracted from CI/CD systems don't make headlines the way ransomware does, but they're often the quiet precursor to something much worse. An attacker with valid AWS keys from a JetBrains pipeline could be sitting in downstream environments right now, doing reconnaissance, waiting for the moment no one is watching. The incident date was "last month." The advisory came out when it did. That gap — and what happened inside it — is the story we don't have visibility into yet.
Organizations running Cadence should treat this as a confirmed breach of their credential supply chain, not a vendor's internal problem that doesn't affect them. The rotation guidance isn't a precaution — it's the correct response to a known exposure.
— HackWire Editorial
## Related Coverage