Atlassian patches critical file-access flaw in Jira and Confluence

Atlassian has warned customers of a critical vulnerability, CVE-2026-21589, that enables arbitrary file access across several self-hosted Data Center products, including Confluence, Jira and Bitbucket.

The flaw allows an unauthenticated attacker to reach specific files within the application's web root directory. Exploitation, however, requires prior knowledge of the target file's exact name and path. The advisory stresses that the vulnerability does not let attackers enumerate or list directory contents.

Affected products

The issue is present in every version released before the fixed builds. Patches have been issued for Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, as well as Crucible and Fisheye. The exact fixed version numbers for each product are listed in the official advisory.

Atlassian urges administrators of self-hosted instances to apply the updates immediately. Cloud customers need to take no action, as the vendor has already patched the products automatically.

Temporary mitigations

If patching right away is not possible, the company recommends restricting external network access — including for internet-facing instances that require user authentication.

Temporary workarounds include adding a web application firewall (WAF) or proxy rule that blocks specified traversal patterns, configuring Tomcat RewriteValve rules for Confluence, JSM, Jira, Bamboo and Crowd, or a URL rewrite rule for Bitbucket. The advisory provides step-by-step instructions and configuration details. The changes must be applied to every cluster node, including Bitbucket mirrors and mirror farm nodes.

Atlassian says it has no evidence that CVE-2026-21589 is being exploited in the wild, but advises administrators to review access logs for the traversal patterns described in the bulletin. The vendor adds that it cannot determine whether individual customer instances have been compromised and encourages owners of self-hosted systems to engage their local security teams.

Source: Bleeping Computer