JetBrains disclosed a security breach of its Cadence platform after attackers exploited an unpatched critical vulnerability in TeamCity CI/CD software to compromise JetBrains infrastructure and extract AWS credentials.
The incident occurred last month when threat actors leveraged a recently disclosed critical flaw in TeamCity to gain initial access to JetBrains systems running Cadence, a workflow orchestration platform. The attackers subsequently extracted AWS credentials from the compromised environment, creating a direct risk to customers using Cadence to manage infrastructure and deployments.
JetBrains has instructed all Cadence users to immediately revoke and rotate credentials and secrets that may have been exposed. This advisory applies specifically to any authentication material used to run Cadence executions. The company's guidance suggests the breach window is still under investigation and the full scope of exposed data remains unclear.
The root cause centers on a critical vulnerability in JetBrains TeamCity, a continuous integration and continuous deployment platform widely used in software development pipelines. TeamCity hosts build agents, manages deployment workflows, and stores sensitive authentication tokens. Once threat actors gained entry through the TeamCity flaw, they could pivot to extract credentials from connected systems including AWS environments.
This breach highlights a persistent pattern in enterprise security. TeamCity runs deeply embedded in development infrastructure, connecting to version control systems, artifact repositories, cloud accounts, and production environments. A single unpatched vulnerability in this layer provides attackers a high-value entry point for lateral movement and credential harvesting.
The timing of the incident matters. The critical TeamCity vulnerability was recently disclosed publicly, meaning security teams had limited time to patch before exploitation began. This narrow window between disclosure and active exploitation demonstrates why patch management remains a security imperative for systems handling credentials and controlling infrastructure.
AWS credentials pose particular risk when exposed. These credentials grant programmatic access to cloud resources without requiring multi-factor authentication. An attacker possessing AWS keys can enumerate, modify, or destroy cloud infrastructure, access stored data, and pivot to additional services. Recovery requires immediate credential revocation, environmental audit, and CloudTrail log analysis to identify unauthorized API calls.
Cadence users operate across multiple sectors including financial services, healthcare, and technology. Organizations using Cadence to orchestrate deployments likely stored elevated-privilege credentials within the platform. The compromised AWS credentials may grant permissions to create instances, modify security groups, access databases, or deploy applications.
JetBrains has not disclosed the identity of threat actors responsible for the breach. The attack methodology suggests either opportunistic exploitation of public vulnerability announcements or targeted reconnaissance of high-value development infrastructure. Cadence's positioning as an orchestration platform makes it attractive to attackers seeking persistent access across customer environments.
The response requirement extends beyond Cadence users. Organizations running unpatched TeamCity instances should assume their environments may have been similarly compromised. This necessitates immediate patching, credential rotation across dependent systems, and log review for unauthorized access indicators.
This incident demonstrates why CI/CD platforms require the same security vigilance as production systems. A vulnerability in development infrastructure can propagate to customer environments, cloud accounts, and operational technology. JetBrains customers and TeamCity operators must prioritize patch deployment and credential management across their entire pipeline infrastructure.