Advisory · CVE-2026-21589
Unauthenticated file read across Atlassian Data Center products
An unauthenticated attacker who knows the exact file path can read files from the web root of affected Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible, and Fisheye Data Center instances. Atlassian rates it critical at CVSS 9.3.
- Vendor
- Atlassian
- Product
- Atlassian Data Center products
- Identifier / CWE
- CVE-2026-21589
CWE-552 - Action timing
- Immediate
Explain it like I’m five
The app has a filing cabinet behind the front desk. A visitor who names the exact drawer can be handed files from it, no badge required. The visitor cannot browse the cabinet, only ask for a drawer by its exact name.
- 01Unauthenticated request
An attacker who can reach the instance over the network sends a crafted request without logging in.
- 02File scope escape
The flaw lets the request reach specific files inside the web application's root directory that should not be servable.
- 03Exact path required
Exploitation needs prior knowledge of the target file's exact name and path; the attacker cannot list or enumerate directories.
- 04File returned
In configurations where sensitive files sit in the web root, their contents are returned to the unauthenticated attacker.
What happened
Atlassian disclosed CVE-2026-21589 on October 5, 2026: an arbitrary file access flaw in the Data Center editions of Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye. Atlassian’s own assessment rates it critical at CVSS 4.0 9.3. NVD has a record for the CVE but had not yet published its own CVSS assessment at the time this advisory was written.
An unauthenticated attacker can access specific files within the web application’s root directory. Atlassian cautions that in some configurations there may be sensitive files present, which increases the risk. The attacker must know the exact filename and path; the vulnerability does not allow directory listing. Atlassian says its investigation found no evidence of exploitation, and Atlassian Cloud products are already patched and unaffected.
Fix versions per Atlassian: Bitbucket Data Center 9.4.26, 10.2.8, 10.5.1; Confluence Data Center 9.2.26, 10.2.19; Jira Service Management Data Center 5.12.40, 10.3.26, 11.3.12; Jira Software Data Center 9.12.40, 10.3.26, 11.3.12; Bamboo Data Center 10.2.24, 12.1.12; Crowd Data Center 6.3.7, 7.0.3, 7.1.7, 7.2.4; Crucible 4.9.15; Fisheye 4.9.15. Earlier releases of each line are affected.
What to do
- Inventory self-managed Atlassian instances, including Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye Data Center deployments.
- Upgrade each product to a fixed release on or above the versions Atlassian lists for its line.
- For instances reachable from the public internet, restrict external network access until patched, even where authentication is enabled.
- Review web access logs for requests targeting unusual static paths or repeated probes against known file names.
- Determine which files in each instance’s web root would be sensitive if read unauthenticated, and rotate any exposed secrets or credentials.
- Confirm the deployed version after patching.
Management note
This is a vendor-scored critical, unauthenticated read of server files on products many teams self-host precisely to keep data in-house. The exploit requires knowing exact paths, which limits opportunistic scanning but not targeted attacks: file names for these products are well known. Treat patching and a review of what sits in the web root as one task.