CVE-2026-21584
HighCVSS 8.1Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Bamboo Data Center versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 have an Improper Authorization vulnerability (CVSS 7.6). An authenticated attacker can gain unintended access, potentially exposing resources or functionality, leading to sensitive information disclosure or arbitrary code execution.
Risk Assessment
An attacker with a user account can access data or functions they should not have permissions for, potentially leading to confidentiality or integrity breaches.
Recommendation
Upgrade Bamboo Data Center to version 10.2.22 or later (for 10.2) or to version 12.1.10 or later (for 12.1).
Other vulnerabilities in Bamboo Data Center
See all- CVE-2026-21571High
Bamboo Data Center contains a critical OS command injection vulnerability (RCE) with CVSS 9.4. An authenticated attacker can execute commands on the remote system, with high impact on confidentiality, integrity, and availability. Affected versions are 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0.
- CVE-2026-21570High
This High severity RCE (Remote Code Execution) vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This RCE vulnerability, with a CVSS Score of 8.6, allows an authenticated attacker to execute malicious code on the remote system.
Original NVD description (English source)
This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center. This Improper Authorization vulnerability, with a CVSS Score of 7.6, allows an authenticated attacker to gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code. Atlassian recommends that Bamboo Data Center customers upgrade to latest version, if you are unable to do so, upgrade your instance to one of the specified supported fixed versions: * Bamboo Data Center 10.2: Upgrade to a release greater than or equal to 10.2.22 * Bamboo Data Center 12.1: Upgrade to a release greater than or equal to 12.1.10 See the release notes (https://confluence.atlassian.com/bambooreleases/bamboo-release-notes-1189793869.html). You can download the latest version of Bamboo Data Center from the download center (https://www.atlassian.com/software/bamboo/download-archives). This vulnerability was reported via our Penetration Testing program.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS