Cybersecurity
Atlassian warns of file-access flaw in Jira and Confluence
Atlassian said CVE-2026-21589 could let an unauthenticated attacker access specific files in several self-hosted Data Center products, and it told administrators to install updates or apply mitigations.
- Atlassian said CVE-2026-21589 could be used for arbitrary file access in several self-hosted Data Center products.
- The company said exploitation needed the exact file name and path, and did not allow directory listing.
- Atlassian said it had no evidence that the flaw was being used in attacks.
- Cloud customers did not need to take action because Atlassian said it had already patched those products.
Atlassian warned customers about CVE-2026-21589, which it said could let an unauthenticated attacker reach specific files in the web root of affected products. The company said the issue applied to multiple self-hosted Data Center offerings, including Bitbucket, Confluence, Jira, Bamboo, Crowd, Crucible and Fisheye.
The advisory said the attacker would need to know the exact file name and path. Atlassian also said the issue did not let an attacker list directory contents.
The vendor listed fixed versions for each affected product and urged administrators of self-hosted systems to apply updates at once. It said cloud customers did not need to act because the products had been patched automatically.
If patching was not possible, Atlassian advised restricting external network access and using temporary mitigations such as WAF, proxy, Tomcat RewriteValve or URL rewrite rules depending on the product. It said customers should review logs for the traversal patterns described in its bulletin and consult local security teams if needed.
Named in this story
Companies
- Atlassian
- issued the advisory and said customers should patch
Products and systems
- Bitbucket Data Center
- was listed among the affected products
- Confluence Data Center
- was listed among the affected products
- Jira Service Management Data Center
- was listed among the affected products
- Jira Software Data Center
- was listed among the affected products
- Bamboo Data Center
- was listed among the affected products
- Crowd Data Center
- was listed among the affected products
- Crucible
- was listed among the affected products
- Fisheye
- was listed among the affected products
How the source tells it
The piece read as a plain security notice, with a mild urgency created by repeated instructions to patch and restrict access.
- urgency repeated calls for immediate patching and interim access restrictions