Atlassian Data Center products let unauthenticated requests read named files
On October 5, 2026, Atlassian published CVE-2026-21589. An unauthenticated attacker who already knows a file's exact path can read that file inside the web root of several self-managed Data Center products. Atlassian rates it critical.
What was reported
Atlassian's advisory, released October 5, 2026, says CVE-2026-21589 allows an unauthenticated attacker to read a specific file under the web application root. The attacker has to already know the file's exact name and path. The bug does not let them list directories. Atlassian says some configurations have sensitive files that raise the risk, and rates the issue critical, 9.3 in its CVSS 4.0 assessment.
The advisory says all versions of those Data Center products before the listed fixes are affected. The fixed lines it names are Bitbucket 9.4.26, 10.2.8, and 10.5.1; Confluence 9.2.26 and 10.2.19; Jira Service Management 5.12.40, 10.3.26, and 11.3.12; Jira Software 9.12.40, 10.3.26, and 11.3.12; Bamboo 10.2.24 and 12.1.12; Crowd 6.3.7, 7.0.3, 7.1.7, and 7.2.4; and Crucible and Fisheye 4.9.15. Jira Service Management 5.12.40 is not a Jira Software build, and Jira Software 9.12.40 is not a Jira Service Management build. Check the advisory before you pick a line, because the right one depends on the product.
Atlassian says it cannot confirm whether a self-managed instance was accessed, and tells operators to have their own security team check the logs.
How to prevent it
Upgrade self-managed Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible, and Fisheye Data Center installs to a fixed version in Atlassian's advisory. If you cannot patch now, take the instance off the public internet. Atlassian says affected Cloud products are already patched and that its investigation found no evidence of exploitation there, so Cloud customers were told they do not need to act.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.