CVE-2026-21584: Atlassian Bamboo Data Center vulnerability
This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code. Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.22 Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.10 See the release notes (https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html). You can download the latest version of Bamboo Data Center from the download center (https://www.atlassian.com/software/bamboo/download-archives). This vulnerability was reported via our Penetration Testing program.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Atlassian Bamboo Data Centerto a version that resolves this vulnerability.Fixed in 10.2.22 - Upgrade
Upgrade
Atlassian Bamboo Data Centerto a version that resolves this vulnerability.Fixed in 12.1.10
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
Exploitation requires an authenticated attacker. The issue can grant unintended access to resources or functionality, which may expose sensitive information or potentially enable arbitrary code execution.
Which Bamboo Data Center deployments should be treated as exposed?
The affected releases listed are 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0. This includes the named release lines without any indication that a non-default configuration is required.
What versions address the vulnerability?
Upgrade to the latest Bamboo Data Center version. If that is not possible, upgrade the 10.2 line to 10.2.22 or later, or the 12.1 line to 12.1.10 or later.