Atlassian fixes critical file-read flaw in its Data Center products

Atlassian fixes critical file-read flaw in its Data Center products

5 October 2026: Atlassian has patched CVE-2026-21589, a critical flaw (CVSS 4.0 score 9.3) that lets an attacker who is not logged in read files from the web application root of every self-managed Data Center product it sells: Jira Software, Jira Service Management, Confluence, Bitbucket, Bamboo and Crowd, plus Crucible and Fisheye. Atlassian Cloud was fixed before the advisory went out. Atlassian says it had seen no exploitation when it published.

How the flaw works

The attacker has to know the exact name and path of the file, because the bug does not allow directory listing. That limits it, but not by much on a standard installation, where file locations are well documented. Atlassian singles out installations that keep sensitive files, such as configuration holding credentials, inside the web root. Once a fix ships, the patch itself shows where to look, which is why advisories like this one tend to be followed by scanning within days.

Which versions are fixed

Every version below these releases is affected:

• Jira Software 9.12.40, 10.3.26 or 11.3.12; Jira Service Management 5.12.40, 10.3.26 or 11.3.12
• Confluence 9.2.26 or 10.2.19
• Bitbucket 9.4.26, 10.2.8 or 10.5.1
• Bamboo 10.2.24 or 12.1.12
• Crowd 6.3.7, 7.0.3, 7.1.7 or 7.2.4
• Crucible and Fisheye 4.9.15

Long-term-support lines have their own fixed release, so a jump to the newest major version is not needed.

If an upgrade has to wait

Atlassian lists three stop-gaps. Take the instance off the internet, including instances that expose only a login page. Or block, at a web application firewall or reverse proxy, any request where two dots sit next to a slash, a backslash or a double colon, in plain or URL-encoded form. Or, for Confluence, Jira, Jira Service Management, Bamboo and Crowd, add the Tomcat RewriteValve configuration the advisory supplies.

Web server and proxy logs since early October are worth a search for path-traversal sequences. If a file holding credentials could have been read, rotate them.

Company profile on TrustList: Atlassian

Related on TrustList:

• Jira Cloud to reject user-property JQL on voters, watchers, creators
• Atlassian removes legacy Jira Forge dashboard modules on 17 May 2027: app makers must migrate to the new dashboards modules

Sources

• Atlassian security advisory: CVE-2026-21589 Arbitrary File Access Vulnerability impacts Multiple Products, 5 October 2026
• The Register: Atlassian warns of critical file access flaw in its Data Center products, 6 October 2026