Atlassian warns of critical file-access flaw in Jira, Confluence and Bitbucket

Atlassian is warning customers about a critical vulnerability, tracked as CVE-2026-21589, that affects self-hosted Data Center products, including Confluence, Jira and Bitbucket.

The flaw allows an unauthenticated attacker to access specific files in an affected application’s web root directory. Exploitation requires prior knowledge of the exact file name and path. Atlassian says the vulnerability does not let attackers enumerate or list directory contents.

The issue affects product versions released before the fixed releases listed in Atlassian’s security advisory. The source material does not include those release numbers. Atlassian urges administrators of self-hosted instances to apply the security updates immediately. Cloud customers do not need to take action because Atlassian has automatically patched the products.

If immediate patching is not possible, Atlassian recommends restricting external network access, including for internet-facing instances that require authentication. Temporary mitigations include web application firewall or proxy rules blocking specified traversal patterns, Tomcat RewriteValve rules for Confluence, JSM, Jira, Bamboo and Crowd, or a URL rewrite rule for Bitbucket. The changes must cover every cluster node, including Bitbucket mirrors and mirror farm nodes.

Atlassian says it has no current evidence that CVE-2026-21589 is being exploited in attacks. It urges administrators to review access logs for the traversal patterns in its bulletin. The company says it cannot determine whether individual customer instances have been compromised and advises self-hosted customers to engage their local security team.