CVE-2026-21584: Improper Authorization in Atlassian Bamboo Data Center
CVE-2026-21584 is a high severity improper authorization vulnerability in Atlassian Bamboo Data Center versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0. It allows an authenticated attacker with low privileges to gain unintended access to resources or functionality, potentially exposing sensitive information or enabling arbitrary code execution. Atlassian recommends upgrading to fixed versions 10.2.22 or later for the 10.2.x branch and 12.1.10 or later for the 12.1.x branch. This vulnerability was discovered through Atlassian's penetration testing program.
AI Analysis
Technical Summary
CVE-2026-21584 is an improper authorization vulnerability affecting multiple versions of Atlassian Bamboo Data Center. The flaw permits an authenticated attacker with low privileges to access unauthorized resources or functionality, which may lead to exposure of sensitive data or execution of arbitrary code. The vulnerability has a CVSS 4.0 base score of 7.6, indicating high severity. Atlassian has released fixed versions 10.2.22 and 12.1.10 to address this issue and recommends users upgrade accordingly.
Potential Impact
An authenticated attacker with low privileges can exploit this vulnerability to gain unauthorized access to Bamboo Data Center resources or functionality. This can result in exposure of sensitive information or potentially allow execution of arbitrary code, posing significant security risks to affected systems.
Mitigation Recommendations
Atlassian has provided official fixes for this vulnerability. Users should upgrade Bamboo Data Center to version 10.2.22 or later if running the 10.2.x branch, or to version 12.1.10 or later if running the 12.1.x branch. If upgrading to the latest version is not feasible, applying these fixed versions is recommended. No other mitigation actions are specified by the vendor.
CVE-2026-21584: Improper Authorization in Atlassian Bamboo Data Center
Description
CVE-2026-21584 is a high severity improper authorization vulnerability in Atlassian Bamboo Data Center versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0. It allows an authenticated attacker with low privileges to gain unintended access to resources or functionality, potentially exposing sensitive information or enabling arbitrary code execution. Atlassian recommends upgrading to fixed versions 10.2.22 or later for the 10.2.x branch and 12.1.10 or later for the 12.1.x branch. This vulnerability was discovered through Atlassian's penetration testing program.
CVSS v4.0
Score 7.6high
Affected software
Atlassian
Bamboo Data Center
pkg:maven/com.atlassian.bamboo/bamboo-data-centerRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-21584 is an improper authorization vulnerability affecting multiple versions of Atlassian Bamboo Data Center. The flaw permits an authenticated attacker with low privileges to access unauthorized resources or functionality, which may lead to exposure of sensitive data or execution of arbitrary code. The vulnerability has a CVSS 4.0 base score of 7.6, indicating high severity. Atlassian has released fixed versions 10.2.22 and 12.1.10 to address this issue and recommends users upgrade accordingly.
Potential Impact
An authenticated attacker with low privileges can exploit this vulnerability to gain unauthorized access to Bamboo Data Center resources or functionality. This can result in exposure of sensitive information or potentially allow execution of arbitrary code, posing significant security risks to affected systems.
Mitigation Recommendations
Atlassian has provided official fixes for this vulnerability. Users should upgrade Bamboo Data Center to version 10.2.22 or later if running the 10.2.x branch, or to version 12.1.10 or later if running the 12.1.x branch. If upgrading to the latest version is not feasible, applying these fixed versions is recommended. No other mitigation actions are specified by the vendor.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- atlassian
- Date Reserved
- 2026-01-01T00:00:40.721Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a84d72ac6e8be0332ceca05
Added to database: 08/18/2026, 22:05:30 UTC
Last enriched: 09/11/2026, 10:17:36 UTC
Last updated: 10/02/2026, 02:46:03 UTC
Views: 68
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.