A Critical Flaw Exposes Sensitive Files in Eight Atlassian Data Center Products

Atlassian has fixed CVE-2026-21589, a critical vulnerability with a CVSS score of 9.3 that allows an unauthenticated attacker to read files located in the root directory of the affected web applications. The flaw affects Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible, and Fisheye in their respective customer-managed Data Center editions. Exploiting it requires prior knowledge of the exact file name and path, while it does not appear possible to freely list directory contents. The risk remains high because configuration files, keys, credentials, or other confidential information could be retrieved without logging in. Atlassian and CSIRT Italia recommend immediately installing the patched versions and reviewing logs for anomalous requests targeting sensitive paths.

Source: 0dayfans