CriticalCVECVE-2026-21589
Critical Atlassian Flaw Lets Unauthenticated Attackers Read Known Files Across 8 Products
The Hacker News·Source published ·1 min read
What happened?
A critical flaw in 8 Atlassian Data Center products, which customers host themselves, allows an attacker with no login access to read specific files in each product's web application root directory. The attacker must already know a file's exact name and path and cannot list what the directory holds. Atlassian disclosed the flaw, CVE-2026-21589, on October 5, rated it 9.3 out of 10, and
Key details
- The attacker must know the exact file name and path and cannot list directory contents.
- Atlassian disclosed CVE-2026-21589 on October 5 with a CVSS 4.0 score of 9.3 and provided fixed versions for each product.
- Cloud products are already patched and cloud customers need no action, but self-hosted instances reachable from the internet should be restricted until upgraded.
Affected
- Bitbucket Data Center versions before 9.4.26, 10.2.8, 10.5.1
- Confluence Data Center versions before 9.2.26, 10.2.19
- Jira Software Data Center versions before 9.12.40, 10.3.26, 11.3.12
- Jira Service Management Data Center versions before 5.12.40, 10.3.26, 11.3.12
- Bamboo Data Center versions before 10.2.24, 12.1.12
- Crowd Data Center versions before 6.3.7, 7.0.3, 7.1.7, 7.2.4
What to look for
- URL-decoded request lines (up to two times) containing .. directly next to /, \, or :: in access logs.
- Raw log lines matching Atlassian's block pattern for the path traversal sequences.
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.