Atlassian discloses file-reading flaw across 8 self-hosted products

Atlassian disclosed a critical vulnerability on October 5 that lets attackers without login access read specific files in 8 Data Center products. The company rated CVE-2026-21589 at 9.3 out of 10 and listed fixed versions. Attackers must know a file's exact name and path; they cannot list directory contents. The flaw uses specially constructed paths to access files in the folder containing the web application, which may hold sensitive files in some configurations. Atlassian advises restricting outside network access until instances are upgraded or temporary blocking rules are installed. Those rules are limited substitutes for patching. Affected cloud products have already been patched, and cloud customers need no action.