Atlassian patches a critical file-read bug in Jira and Confluence
An unauthenticated attacker who knows a file's exact path can read it off eight self-hosted Atlassian products. All versions before the new patches are affected.
Atlassian disclosed CVE-2026-21589 on 5 October, a critical arbitrary file-access flaw that needs no login at all. It carries a CVSS score of 9.3 and hits every version, prior to the new fixes, of eight self-hosted Data Center and Server products: Bitbucket, Confluence, Jira Software, Jira Service Management, Bamboo, Crowd, Crucible and Fisheye.
An attacker can pull a file out of the application’s web root, but only if they already know its exact name and location — the bug gives no way to browse or list a folder’s contents first. Atlassian Cloud was already patched, and the company says its investigation found no evidence of exploitation there. Fixed versions are out for every affected product, including Confluence Data Center 9.2.26 and 10.2.19. Atlassian’s advisory also lists WAF rules and Tomcat rewrite rules as a stopgap for anyone who cannot patch immediately.
Why it matters: these are tools most dev teams self-host somewhere — a code repo, an issue tracker, a wiki. A pre-auth file-read bug on any of them can leak config files, credentials or source, and this one is now public with full technical detail circulating.
The caveat: Atlassian confirms no exploitation on Cloud but does not make the same claim for self-hosted Data Center instances — treat “no reports yet” as a head start, not a reprieve.