#atlassian
-
Atlassian patches critical file-access flaw in Jira and Confluence
The CVE-2026-21589 vulnerability lets an unauthenticated attacker read specific files in a web application's root directory. It affects self-hosted Data Center products, including Confluence, Jira and Bitbucket.
-
Atlassian's Rovo assistant taught to leak Jira and Confluence data to attackers
Two research teams independently showed how a prompt injection can make the corporate Rovo AI assistant gather data available to the user and send it to a stranger's server. Atlassian has already closed one of the vulnerabilities.