Atlassian is warning customers about a critical vulnerability known as CVE-2026-21589 that can be exploited for arbitrary file access in several self-hosted data center products, including Confluence, Jira and Bitbucket.
The security issue allows an unauthenticated attacker to access certain files in the web root of an affected application. However, exploitation requires knowledge of the exact file name and path.
“This arbitrary file access vulnerability allows an unauthenticated attacker to access specific files in the root of the web application in the affected versions,” it said Safety notice.
“The exploitation requires prior knowledge of the exact name and path of the target file. This vulnerability does not allow attackers to enumerate or list directory contents,” says Atlassian.
CVE-2026-21589 affects all product versions released before the versions listed below that address the vulnerability:
- Bitbucket Datacenter: 9.4.26, 10.2.8, 10.5.1
- Confluence Data Center: 9.2.26, 10.2.19
- Jira Service Management Data Center: 12/5/40, 3/10/26, 3/11/12
- Jira Software Data Center: 9.12.40, 10.3.26, 11.3.12
- Bamboo Data Center: 10.2.24, 12.1.12
- Crowd Data Center: 6.3.7, 7.0.3, 7.1.7, 7.2.4
- Crucible: 9/4/15
- Fisheye: 9/4/15
Atlassian urges system administrators managing self-hosted instances to apply the security updates immediately. Cloud customers do not need to take any action as the provider has automatically patched the products.
If immediate patching is not possible, the company recommends restricting external network access, including for Internet-connected instances that require user authentication.
Temporary mitigations include adding a Web Application Firewall (WAF) or proxy rule that blocks specific traversal patterns across all affected products, Tomcat RewriteValve rules for Confluence, JSM, Jira, Bamboo, and Crowd, or a URL rewrite rule for Bitbucket.
Atlassian’s advisory provides step-by-step instructions and configuration details to implement the recommended temporary workarounds.
The changes must cover every cluster node, including Bitbucket mirrors and mirror farm nodes.
Atlassian said it currently has no evidence that CVE-2026-21589 is being exploited for attacks, but urges administrators to review access logs for the traversal patterns described in the bulletin.
The provider says it cannot determine whether individual customer instances have been compromised and urges customers using self-hosted instances to contact their local security team.
