Safety Incident Affecting JetBrains Cadence

We investigated a safety incident affecting JetBrains Cadence. Cadence was a JetBrains-hosted service that built-in with PyCharm by way of an non-compulsory plugin, and allow you to run your tasks on cloud compute sources. The sundown of Cadence was introduced on March 31, 2026, and the service was scheduled to be shut down on August 31, 2026. Our investigation confirmed unauthorized entry to the service and the publicity of buyer information related to its use.

We contacted affected customers straight and took steps to comprise the incident.

This publish gives the most recent details about the incident, its potential affect, and the actions we advocate Cadence customers take. We are going to replace it as our investigation progresses and extra data turns into obtainable.

Final up to date: September 3, 2026, 19:00 CEST

September 3, 2026, 19:00 CEST

Our investigation has recognized extra potential publicity involving storage utilized by the present Cadence setting.

We confirmed that the menace actor obtained entry that would have allowed them to achieve storage containing information related to present Cadence customers, together with electronic mail addresses, mission supply code, and credentials. This impacts the identical group of customers we beforehand contacted straight. These findings didn’t determine any extra affected customers. As a precaution, we’re treating the info saved there as probably uncovered. 

Our investigation has now concluded. The really helpful actions for affected customers stay unchanged.

September 1, 2026, 12:05 CEST

Our investigation is nearing completion, and most mitigation and response actions are actually finalized. Now we have not recognized any extra compromised sources or information since our final replace, and we’re wrapping up a small variety of remaining verification actions. The really helpful actions for affected customers stay unchanged.

August 31, 2026, 12:56 CEST

Our investigation stays ongoing. At the moment, now we have not recognized any extra compromised sources or information.

Now we have confirmed that the menace actor accessed information contained within the Cadence server backup from 2024. At the moment, there isn’t any proof to recommend that the menace actor extracted information, together with secrets and techniques, from the present Cadence setting.

The really helpful actions described beneath stay unchanged.

August 28, 2026, 11:50 CEST

Cadence was a JetBrains-hosted service built-in with PyCharm by way of an non-compulsory plugin, that allow you to run your tasks on cloud compute sources. Its sundown was introduced on March 31, 2026, and the service was scheduled to be shut down on August 31, 2026. Cadence used JetBrains TeamCity to orchestrate this work. We lately disclosed CVE-2026-63077, a important vulnerability in TeamCity that may enable an unauthenticated attacker to execute arbitrary instructions on a weak server.

Now we have since confirmed the Cadence setting was weak to CVE-2026-63077 and was exploited by way of this vulnerability.

Cadence customers ought to instantly revoke or rotate all credentials and secrets and techniques which will have been used to run their Cadence executions. They need to additionally deal with all executions, together with their inputs and outputs in your Cadence mission, as probably untrusted.

Actions required instantly

We strongly advocate that Cadence customers:

• Revoke and rotate all credentials and secrets and techniques which will have been used to run Cadence executions.
• Assessment linked programs for suspicious exercise, significantly AWS accounts, S3 buckets, deployment environments, package deal/container registries, and different programs accessible utilizing credentials talked about above.
• Assessment supply code repositories for unauthorized modifications made throughout the affected interval.
• Assessment any supply code or mission information synchronized to Cadence from PyCharm and rotate any credentials, tokens, or different delicate data contained inside them.
• Deal with all executions, together with their inputs and outputs in your Cadence mission, as probably untrusted.

Cadence customers can contact us to request a listing of the credentials and secrets and techniques related to their Cadence utilization. This may increasingly assist customers determine which credentials must be revoked or rotated, however the stock shouldn’t be thought of exhaustive.

Now we have collated a listing of Indicators of Compromise (IoCs) beneath. These indicators aren’t exhaustive, and the absence of those indicators doesn’t verify that an account or system was unaffected:

• Exercise occurring from August 8, 2026, onwards, significantly authentication or exercise utilizing credentials beforehand saved in or accessible by way of Cadence.
• IP addresses related to noticed exploitation exercise:
  • 150.109.230.104
  • 43.153.227.206
  • 62.210.127.48
  • 210.247.242.190
  • 15.235.225.205
  • 152.233.30.18
• Authentication or different exercise from sudden IP addresses or places.
• Sudden repository clones or downloads, and sudden commits to repositories.
• Adjustments to repository secrets and techniques, webhooks, collaborators, or permissions.
• New or modified private entry tokens, API tokens, or SSH keys in exterior providers.
• New service accounts created in exterior providers.
• Sudden modifications to cloud IAM roles, insurance policies, or permissions.
• Sudden entry to cloud storage, together with S3 buckets and objects, in providers corresponding to AWS and Google Cloud.
• Sudden publication or modification of packages or releases.

Affected server

Now we have confirmed that the next Cadence server was efficiently exploited: api.cadence.jetbrains.com.

Affected interval

August 8, 2026, to August 24, 2026.

What occurred

The Cadence server used TeamCity to orchestrate workloads and was weak to CVE-2026-63077. Menace actors exploited the vulnerability and gained unauthorized entry to the affected Cadence environments, with exercise recognized from August 8, 2026. We found the exploitation on August 23, 2026, and took the affected server offline on August 24, 2026, whereas we continued our investigation.

What we all know

Our investigation is ongoing, however now we have confirmed that the menace actors:

• Accessed private information and extracted it from the affected setting. Confirmed affected private information consists of usernames, actual names, electronic mail addresses, last-login timestamps, and final accessed IP addresses.
• Compromised a full backup of the Cadence server relationship from 2024. This implies credentials, configuration, artifacts, logs, or different information current in that backup should even be handled as probably uncovered.
• Compromised a number of AWS IAM customers and related credentials/secrets and techniques used with Cadence, together with IAM customers belonging to JetBrains staff who used the service. These credentials have been current within the compromised 2024 backup.
• Accessed information saved in S3 buckets inside JetBrains AWS accounts utilized by Cadence. We’re nonetheless figuring out the total scope of the info accessed. We don’t presently know whether or not the menace actors accessed storage buckets in buyer accounts. Nonetheless, some customers might have configured Cadence to entry their very own storage buckets, and the credentials used for these connections might have additionally been uncovered.
• Could have accessed supply code synchronized from PyCharm tasks to the affected server. In the event you used PyCharm to add or synchronize mission information for execution in Cadence, you need to deal with that code, and any credentials or configuration contained inside it, as probably compromised.

The possible penalties of the non-public information publicity embrace an elevated danger of focused phishing, social engineering, impersonation, and different unsolicited or malicious communications utilizing the affected names and electronic mail addresses.

Because the menace actors gained entry to the Cadence server, any credentials or secrets and techniques saved in Cadence, contained within the compromised backup, or made obtainable to executions on the affected server needs to be thought of compromised and should be revoked or rotated.

This consists of however shouldn’t be restricted to:

• Cloud credentials, together with AWS, Azure, and Google Cloud.
• Supply management credentials and tokens, together with GitHub, GitLab, and Bitbucket.
• Package deal repository credentials, together with npm, Maven, NuGet, PyPI, and related providers.
• Container registry credentials, together with Docker Hub, ECR, GCR, ACR, and different registries.
• Slack tokens, webhooks, API tokens, SSH/deployment keys, service account credentials, signing keys/certificates, and credentials for every other exterior programs utilized by your Cadence executions.

Actions JetBrains has taken

We took the Cadence server offline on August 24, 2026, whereas we proceed to analyze the incident. At current, now we have confirmed that the incident is proscribed to information related to the Cadence host talked about above.

The server ought to have been patched as a part of our response to the vulnerability, nevertheless it was not. We sincerely apologize for this failure and the affect it might have on you.

Now we have invalidated all entry tokens utilized by the JetBrains Cadence plugin in PyCharm to hook up with Cadence, and took the server offline on August 24, 2026.

We’re additionally notifying the related authorities and taking the mandatory steps to guard the info of Cadence customers.

Additional updates

We are going to publish additional findings and steering right here as our investigation progresses. We advocate checking this web page steadily for the most recent data. We will even contact affected customers straight if we determine any essential new data which will require motion on their half.

For extra details about the underlying vulnerability, please see our authentic safety advisory to TeamCity clients and customers.

In the event you beforehand used Cadence and want help figuring out which credentials might have been uncovered or have any questions concerning this incident, contact the JetBrains Safety crew at safety@jetbrains.com.

We acknowledge the seriousness of this incident and apologize once more for the affect.