CVE-2026-21584 is an improper authorization flaw in Atlassian Bamboo Data Center. The record scores it 8.1 (High), while Atlassian rates it 7.6 (High). An authenticated attacker can gain access to resources or functions they should not have. Atlassian says to upgrade to a fixed release such as 10.2.22 or 12.1.10 or later.
What's affected
Atlassian's issue BAM-26468 lists these Bamboo Data Center versions as affected: 10.0.0 through 10.2.21, 11.0.0 through 11.0.8, 11.1.0, 12.0.0 through 12.0.2, and 12.1.0 through 12.1.9. The advisory text says the flaw was introduced in 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0 and 12.1.0.
Fixed versions named by Atlassian: any release at or above 10.2.22 for the 10.2 line, and at or above 12.1.10 for the 12.1 line. Atlassian recommends the latest release. The page we read does not name a fixed release for the 11.x line, so if you run 11.x, read the advisory and plan a move to a supported release.
Source conflict to note: the CVE record gives CVSS 3.1 score 8.1 (High) with a network vector, and Atlassian gives 7.6 (High) using CVSS 4.0. Both rate it High.
Weakness class: CWE-285, improper authorization.
How to check if you're exposed
In Bamboo, read the running version from the footer of any page or from the administration area. Compare it with the ranges above. For a clustered Data Center install, check every node, because rolling upgrades can leave nodes on different versions for a while.
Atlassian lists no workaround, so there is no configuration check that proves you are safe. The version number is the test. Also review who holds accounts: the flaw needs an authenticated attacker, so the number of users with Bamboo logins, including service accounts and former staff, sets how many people could try it.
What to do now
- Upgrade Bamboo Data Center to 10.2.22 or later on the 10.2 line, or 12.1.10 or later on the 12.1 line. Atlassian recommends the latest release.
- If you run 11.x, 12.0.x or another listed line without a named fixed release, read the Atlassian advisory and move to a fixed supported version.
- Remove stale Bamboo accounts and tokens, and review permissions on build plans and deployment projects.
- Review build agents and stored credentials. Atlassian says the flaw can lead to exposure of sensitive information or, possibly, code execution, and build servers often hold deployment secrets.
- Rotate any secrets stored in Bamboo if you cannot rule out misuse, using your own audit logs as the guide.
Why it matters
Improper authorization means the server checks that you are logged in but not that you are allowed to do the specific thing you asked for. Atlassian describes the impact as unintended access to resources or functionality, possibly exposing sensitive information or even allowing arbitrary code execution.
CI servers are attractive targets because they sit between source code and production. They hold tokens, deploy keys and build scripts. Even a low-privilege account bug deserves a prompt upgrade. The record's KEV flag is false and Atlassian's page does not report exploitation, so this is a high priority patch, not a known active campaign.
Try it yourself
This walkthrough shows how a vulnerability like this moves from detection to a tracked fix across your estate.
Click through it at your own pace, or open it full screen.
Quick check
Does an attacker need an account?
Yes. The record and Atlassian both describe an authenticated attacker, with low privileges required.
Is there a workaround?
None is listed on the Atlassian page we read. Upgrading is the remedy.
Sources
Last reviewed: 18 October 2026.
