CVE-2026-21589 – Atlassian Bamboo Data Center

Atlassian has patched an arbitrary file access flaw in Bamboo Data Center. CVE-2026-21589 has a CVSS score of 9.3, Critical severity. An unauthenticated remote attacker can read specific files in the web application root directory. The attacker must already know each file's exact name and path, because the flaw does not allow directory listing. Where sensitive files sit in that directory, the exposure is severe. Proof-of-concept code for this vulnerability exists.

The same flaw affects Bitbucket, Confluence, Crowd, Jira Software and Jira Service Management Data Center, plus Crucible and Fisheye. Bamboo Data Center 7.0.1 and later is affected, and fix versions 10.2.24 and 12.1.12 close the gap. Apply the fixed release to every affected Atlassian Data Center product now.