Atlassian Patches Critical CVE-2026-21589 File-Read Flaw Across Bitbucket, Jira, Bamboo and Five Other Data Center Products
Atlassian disclosed CVE-2026-21589, a 9.3-rated path traversal letting unauthenticated attackers read known files in eight self-hosted products, with fixes listed for each.
Overview
Atlassian has disclosed a critical flaw affecting eight self-hosted products, several of them core developer tooling. According to The Hacker News, the flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each product’s web application root directory. The same outlet reports that Atlassian disclosed the flaw, CVE-2026-21589, on October 5 and rated it 9.3 out of 10. The CVE record carries a publication timestamp of 2026-10-05T21:30:00.390Z.
What We Know
The flaw
The CVE record describes an arbitrary file access vulnerability that allows an unauthenticated attacker to access specific files within the web application root directory in affected versions. It lists the weakness type as “Path Traversal (Arbitrary Read/Write)”. Exploitation is limited: per the CVE record, it “requires prior knowledge of the target file’s exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents.”
The 9.3 score uses CVSS version 4.0, and The Hacker News notes it is Atlassian’s own rating. The CVE record gives the vector as CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H.
Affected products and fixed versions
The Hacker News reports that the flaw affects all versions of the eight products before the fixed versions, and lists the following fixes as of October 6:
- Bitbucket Data Center: 9.4.26, 10.2.8, 10.5.1
- Confluence Data Center: 9.2.26, 10.2.19
- Jira Software Data Center: 9.12.40, 10.3.26, 11.3.12
- Jira Service Management Data Center: 5.12.40, 10.3.26, 11.3.12
- Bamboo Data Center: 10.2.24, 12.1.12
- Crowd Data Center: 6.3.7, 7.0.3, 7.1.7, 7.2.4
- Crucible: 4.9.15
- Fisheye: 4.9.15
The CVE record also gives the earliest affected release lines for several products, including Bitbucket Data Center from version 4.6.0, Confluence Data Center from 5.10.0, Jira Software Data Center from 7.1.0 and Bamboo Data Center from 7.0.1.
Discrepancies in Atlassian’s own records
The fixed-version data is not fully consistent across Atlassian’s records, according to The Hacker News. For Crowd’s 7.1 branch, the outlet reports that the ticket’s fix version field said 7.1.7, while a table in the same ticket showed 7.1.6, which the ticket also listed as an affected version. The CVE record, by contrast, lists 7.1.1 for Crowd; this is visible in the record itself. For Bamboo, The Hacker News reports that one field of the record said 10.2.4 while the description said 10.2.24. The record’s description text gives 10.2.24.
The Hacker News further reports that the CVE record marked every version of Bamboo Server, Bitbucket Server, Confluence Server, and Crowd Server as affected and listed no fixed versions for them. The outlet says the advisory did not mention those Server editions.
Mitigations and exploitation status
For customers who cannot upgrade immediately, The Hacker News describes three temporary blocking rules that block requests whose URL contains .. directly next to /, \ or ::, including URL-encoded forms. A web application firewall or reverse proxy rule applies to all eight products. A Tomcat RewriteValve rule applies to Confluence, Jira Software, Jira Service Management, Bamboo and Crowd, and a urlrewrite.xml rule applies to Bitbucket. Crucible and Fisheye have only the first option. Atlassian says in its product tickets that the mitigations “are limited and not a replacement for patching your instance,” per the same report.
Atlassian said its affected cloud products have been patched and that its investigation has not found evidence of exploitation, and Bitbucket Cloud is not affected, according to The Hacker News.
What We Don’t Know
- Whether self-hosted instances have been attacked. The Hacker News reports that the advisory does not say whether attacks on self-hosted instances have been seen, and quotes Atlassian as saying it cannot confirm if customers’ instances have been affected.
- Which files are at risk. According to The Hacker News, the advisory does not identify the sensitive files or the configurations that contain them.
- Which Crowd 7.1 fix version is authoritative, given the 7.1.1, 7.1.6 and 7.1.7 figures described above.
Context
The Hacker News notes that attackers have exploited this kind of flaw in an Atlassian product before: CVE-2021-26086 is a path traversal vulnerability in Jira Server and Data Center that allows remote attackers to read specific files, and the U.S. Cybersecurity and Infrastructure Security Agency added it to its known exploited vulnerabilities catalog on November 12, 2024. No source reviewed for this article reports exploitation of CVE-2026-21589.