JetBrains Urges Cadence Users to Rotate Credentials After Critical TeamCity Attack
JetBrains has urged users of its Cadence cloud computing platform to immediately revoke and rotate credentials and secrets after attackers exploited a critical TeamCity vulnerability to compromise its environment.
The software development company said the incident allowed unidentified threat actors to gain access to a Cadence server and potentially reach sensitive credentials, cloud storage, source code, and other data associated with affected users.
The incident is linked to CVE-2026-63077, a critical TeamCity vulnerability with a CVSS score of 9.8 that can allow an unauthenticated attacker to bypass authentication and execute arbitrary operating system commands on vulnerable servers.
Critical TeamCity Vulnerability Used in the Attack
The vulnerability is a deserialization of untrusted data flaw in TeamCity. An attacker with network access to a vulnerable TeamCity server can exploit the issue to bypass authentication protections and execute commands with the privileges of the TeamCity server process.
The vulnerability has already been exploited in the wild. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-63077 to its Known Exploited Vulnerabilities catalog on August 5, 2026.
JetBrains discovered exploitation involving its Cadence environment on August 23, 2026.
The company said the intrusion occurred between August 8 and August 24, 2026. The affected Cadence server, api.cadence.jetbrains.com, has since been taken offline.
JetBrains acknowledged that the affected server should have been patched as part of its vulnerability response process but did not disclose why the system remained vulnerable.
What Is JetBrains Cadence?
Cadence is a JetBrains-hosted cloud computing service designed to allow developers to run machine learning workloads and other resource-intensive tasks on cloud GPUs.
The service integrates with PyCharm through an optional plugin, allowing developers to upload or synchronize project files and execute workloads remotely.
Because Cadence can interact with source code, credentials, cloud infrastructure, and external services, a compromise of the environment could potentially expose sensitive development resources.
Cadence Backup From 2024 Was Accessed
In follow-up updates, JetBrains said the attackers accessed a full Cadence server backup from 2024.
The backup potentially contained:
- Credentials and secrets
- Server configuration
- Application artifacts
- Logs
- Other Cadence-related data
- AWS IAM credentials
- Information associated with JetBrains employees who used Cadence
JetBrains also said attackers obtained access that could potentially reach storage containing information belonging to current Cadence users.
The company stressed that users should treat information stored on the affected systems as potentially exposed.
Personal Information May Also Be Exposed
The compromised environment contained personal information associated with users.
According to JetBrains, the potentially affected information includes:
- Usernames
- Real names
- Email addresses
- Last-login timestamps
- Last accessed IP addresses
The exposure could increase the risk of targeted phishing, social engineering, impersonation, and other malicious communications.
JetBrains said the findings did not identify additional affected users beyond the group it had previously contacted directly.
AWS Credentials and S3 Data at Risk
One of the most significant concerns involves cloud credentials.
JetBrains confirmed that multiple AWS IAM users and associated credentials or secrets used with Cadence were extracted from the 2024 backup.
Some of these IAM accounts belonged to JetBrains employees who had used the Cadence service.
The company also said files stored in S3 buckets within JetBrains AWS accounts used by Cadence were accessed.
As a result, users are being advised to investigate their cloud environments for unauthorized activity rather than simply replacing their Cadence credentials.
Source Code Could Also Have Been Exposed
JetBrains warned that attackers may have accessed source code synchronized from PyCharm projects to the affected Cadence server.
This could affect users who uploaded or synchronized project files to Cadence for remote execution.
Depending on the contents of those projects, exposed files could potentially include:
- Proprietary source code
- API keys
- Cloud credentials
- Configuration files
- Deployment information
- Repository secrets
JetBrains therefore recommends treating Cadence executions, inputs, and outputs as potentially untrusted.
JetBrains Invalidates Cadence Plugin Tokens
As part of its response, JetBrains has invalidated access tokens used by the JetBrains Cadence plugin in PyCharm to connect to Cadence.
The company has also taken the compromised Cadence server offline.
However, simply disabling the affected server does not eliminate the potential impact of credentials or secrets that may have been extracted before the shutdown.
JetBrains Lists Indicators of Compromise
JetBrains provided several indicators and behavioral signs that organizations should investigate.
Suspicious IP Addresses
The following IP addresses were associated with observed exploitation activity:
150.109.230.10443.153.227.20662.210.127.48210.247.242.19015.235.225.205152.233.30.18
Organizations should review authentication and network logs for unexpected activity involving these addresses, particularly from August 8, 2026 onward.
Additional Signs of Compromise
Security teams should also look for:
- Authentication from unexpected IP addresses or geographic locations
- Unexpected repository clones or downloads
- Unauthorized repository commits
- Changes to repository secrets
- Modified webhooks
- New or removed collaborators
- Changes to repository permissions
- Newly created or modified personal access tokens
- Unexpected API tokens or SSH keys
- Newly created service accounts
- Unexpected AWS IAM role or policy changes
- Suspicious cloud storage access
- Unexpected S3 bucket or object activity
- Unauthorized package or container registry activity
- Unexpected publication or modification of packages and releases
What Cadence Users Should Do Now
JetBrains recommends that affected users take immediate action rather than waiting for further details about the investigation.
1. Rotate All Credentials
Revoke and rotate credentials and secrets that may have been:
- Stored in Cadence
- Present in the compromised backup
- Available to Cadence executions
- Used by workloads executed through the affected server
2. Review Cloud Accounts
Organizations should audit connected cloud environments, particularly:
- AWS accounts
- S3 buckets
- IAM users
- IAM roles
- Deployment environments
- Package registries
- Container registries
Look for unexpected authentication, permission changes, newly created accounts, and unusual downloads.
3. Audit Source Code Repositories
Teams should review repositories for:
- Unexpected commits
- Unauthorized clones
- Unexpected downloads
- Modified secrets
- New SSH keys
- New API tokens
- Webhook changes
- Permission changes
- Unknown collaborators
4. Treat Cadence Executions as Untrusted
JetBrains specifically recommends treating all executions, inputs, and outputs associated with affected Cadence projects as potentially untrusted.
Organizations should review workloads executed during the affected period and investigate any unexpected behavior.
Who Is Behind the Attack?
JetBrains has not attributed the intrusion to a specific threat actor.
The company said the attack involved activity between August 8 and August 24, 2026, but has not publicly identified the attackers or explained their ultimate objective.
The incident demonstrates how exploitation of a vulnerable development infrastructure component can potentially provide attackers with access to much broader resources, including source code, cloud credentials, CI/CD infrastructure, and deployment environments.
Why This Incident Matters
The Cadence incident highlights the risks associated with modern developer platforms that connect IDEs, cloud computing environments, source-code repositories, credentials, and cloud infrastructure.
A compromise of one server can become significantly more serious when that server has access to development projects and privileged cloud credentials.
The incident also demonstrates why organizations should not assume that patching a vulnerable server alone is sufficient after a confirmed compromise. Credentials, tokens, secrets, repository access, and cloud permissions must also be investigated and rotated.
JetBrains has advised potentially affected users to assume that credentials and secrets accessible through the compromised Cadence environment may have been exposed and to take defensive action accordingly.
