Atlassian warns of critical file-access flaw in Jira, Confluence
Atlassian warns CVE-2026-21589 allows unauthenticated file access in self-hosted Jira, Confluence, Bitbucket, and other Data Center products.
Atlassian disclosed CVE-2026-21589, a critical arbitrary file-access flaw in several self-hosted Data Center products. An unauthenticated attacker who knows a file's exact name and path can read specific files in the web root but cannot list directories. Fixes include Confluence 9.2.26 and 10.2.19, Jira Software 9.12.40, 10.3.26, and 11.3.12, plus updates for Bitbucket, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye. Cloud instances were patched automatically, and Atlassian says it has no evidence of exploitation.
- CVE-2026-21589 allows unauthenticated access to specific web-root files.
- Attackers must already know the exact file name and path.
- Self-hosted Jira, Confluence, Bitbucket, Bamboo, Crowd, Crucible, and Fisheye are affected.
- Atlassian reports no evidence of exploitation; cloud products are already patched.
- Temporary mitigations include access restrictions and WAF or rewrite rules.
Vulnerabilities mentionedAll →
- CVE-2026-215899.32%This: Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access…published PoC ×7
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-21589 | This: Crowd Data Center, Crucible and Fisheye. This Arbitrary File Access vulnerability allows an unauthenticated attacker to access… |
Full article386 words · extracted from bleepingcomputer.com · click to collapse
Atlassian is warning customers of a critical vulnerability, tracked as CVE-2026-21589, that can be exploited for arbitrary file-access in multiple self-hosted Data Center products, including Confluence, Jira, and Bitbucket.
The security issue allows an unauthenticated attacker to access specific files within an affected application's web root directory. However, exploitation requires knowing the exact name of the file and path.
“This Arbitrary File Access vulnerability allows an unauthenticated attacker to access specific files within the web application root directory in affected versions,” reads the security advisory.
“Exploitation requires prior knowledge of the target file's exact name and path; this vulnerability does not allow attackers to enumerate or list directory contents,” Atlassian says.
CVE-2026-21589 affects all product versions released before the releases listed below, which address the vulnerability:
- Bitbucket Data Center: 9.4.26, 10.2.8, 10.5.1
- Confluence Data Center: 9.2.26, 10.2.19
- Jira Service Management Data Center: 5.12.40, 10.3.26, 11.3.12
- Jira Software Data Center: 9.12.40, 10.3.26, 11.3.12
- Bamboo Data Center: 10.2.24, 12.1.12
- Crowd Data Center: 6.3.7, 7.0.3, 7.1.7, 7.2.4
- Crucible: 4.9.15
- Fisheye: 4.9.15
Atlassian urges system administrators who manage self-hosted instances to apply the security updates immediately. Cloud customers need to take no action, as the vendor has automatically patched the products.
If immediate patching is not possible, the company recommends restricting external network access, including for internet-facing instances that require user authentication.
Temporary mitigations include adding a web application firewall (WAF) or proxy rule blocking specified traversal patterns across all affected products, Tomcat RewriteValve rules for Confluence, JSM, Jira, Bamboo, and Crowd, or a URL rewrite rule for Bitbucket.
Atlassian's advisory offers step-by-step instructions and configuration details to implement the recommended temporary mitigations.
The changes must cover every cluster node, including Bitbucket mirrors and mirror farm nodes.
Atlassian said it currently has no evidence that CVE-2026-21589 is being exploited in attacks, but urges administrators to review access logs for the traversal patterns described in the bulletin.
The vendor says it cannot determine whether individual customer instances have been compromised, urging customers using self-hosted instances to engage with their local security team.
Build your security blueprint for AI-powered attacks
Join Mikko Hyppönen and security leaders from the NFL, CHANEL, and Atlassian for a two-hour digital summit on what AI-speed attacks change, what defenders should stop doing, and how to validate, decide, fix, and re-validate at machine speed.
Akamai Blog