Arbitrary File Access Vulnerability in Atlassian Products
CVE-2026-21589

9.3CRITICAL

Key Information:

Vendor: Atlassian
Status: Bamboo Data Center; Bamboo Server; Bitbucket Data Center; Bitbucket Server
Vendor: CVE Published:; 5 October 2026

What is CVE-2026-21589?

This vulnerability affects several Atlassian Data Center products, enabling an unauthenticated remote attacker to gain access to specific files within the web application root directory. Essential exploitation requires prior knowledge of the exact file names and paths, with no ability to enumerate directory contents. In some configurations, the exposure of sensitive files could lead to severe repercussions.

Affected Version(s)

Bamboo Data Center All other versions

Bamboo Server All versions

Bitbucket Data Center All other versions

References

https://jira.atlassian.com/browse/BAM-26567

https://jira.atlassian.com/browse/BSERV-20604

https://jira.atlassian.com/browse/CONFSERVER-104488

CVSS V4

Score:

9.3

Severity:

CRITICAL

Confidentiality:

High

Integrity:

None

Availability:

None

Attack Vector:

Network

Attack Complexity:

Low

Attack Required:

None

Privileges Required:

Undefined

User Interaction:

None

Download the Critical Vulnerability Management Cheat Sheet

Timeline

Vulnerability published
Oct 5, 2026
Vulnerability Reserved
Jan 1, 2026

CVE-2026-21589 Data

JSON