The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
Atlassian’s critical flaw turns eight enterprise products into one big security problem
- Published
- Record updated
Summary
Atlassian disclosed CVE-2026-21589, rated 9.3 (critical), an arbitrary file access vulnerability affecting Bamboo Data Center, Bitbucket Data Center, Confluence Data Center, Crowd Data Center, Crucible, Fisheye, Jira Service Management Data Center, and Jira Software Data Center. It lets unauthenticated attackers use path traversal to read files outside the web application root, provided they already know the exact file name and path, since directory listing is not possible.
Mitigation
Patch to the latest fixed versions. Until patching is possible, remove affected instances from the internet and restrict internet-accessible instances from external network access. Temporary mitigations include a Web Application Firewall or proxy rule, and a Tomcat RewriteValve rule on each node for Bamboo, Confluence, Crowd, Jira Software, and Jira Service Management, followed by a node shutdown and restart. Bitbucket users can apply a urlrewrite.xml rule to every node, mirror, and mirror farm node, then restart. Atlassian describes these mitigations as limited and not a replacement for patching.