Atlassian warns of critical file access flaw in its datacenter products
Tells users ‘action required’ – but maybe don’t make that action a Jira ticket, because it has this bug
Atlassian has issued an urgent warning to users of its datacenter products, urging them to patch the software to prevent attackers from accessing their files. The company has identified a serious security flaw, CVE-2026-21589, a 9.3-rated arbitrary file access vulnerability, affecting several of its products including Bitbucket, Confluence, and Jira Software.
This vulnerability allows an unauthenticated attacker to access specific files within the web application root directory, potentially exposing sensitive data under certain configurations. However, the attacker must know the exact filename and path to exploit this vulnerability, and it does not provide access to directory contents.
Atlassian has released updated versions of its software, but users have until they can act to upgrade or remove their instances from the internet, if possible. The company advises those unable to patch to restrict external network access to their instances. Users who migrated their operations to Atlassian's cloud services are unaffected, as the cloud version already includes the fix.
Atlassian's decision to transition users from their low-end server products to its cloud platform in 2020 appears to have been justified, as its share price has tripled since the implementation, suggesting investor confidence in the company’s strategy to utilize AI to enhance workflow capabilities.
Written by urgent.news from The Register Science's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
