InfoSecBulletin Cybersecurity for mankind
Atlassian has fixed CVE-2026-21589, a serious flaw in Atlassian Data Center with a score of 9.3. This bug allows an attacker without an account to read files from the web application root. It impacts all versions of eight self-managed products, like Jira, Confluence, and Bitbucket.
Why It Matters
Critical Atlassian & IBM Flaws Expose Files and Enable Remote Code Execution
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
Atlassian’s self-managed tools are essential for many development and IT teams. Source code, tickets, build pipelines, and user directories are often stored on these servers. Because of this, an Atlassian Data Center weakness affects a large part of the software supply chain. One flaw impacts eight products at the same time:
Jira Data Center and Jira Service Management Data Center
Confluence Data Center
Bitbucket Data Center
Bamboo Data Center
Crowd Data Center
Fisheye and Crucible
Cloud customers can feel safe. Atlassian says that “affected Atlassian Cloud products have been fixed, and our investigation found no proof of problems.” The company adds that Bitbucket Cloud is okay. For self-managed instances, there is no evidence of exploitation in the wild or public proof of the issue.
How the Attack Works
Atlassian calls the bug path traversal. It “lets an attacker without permission reach certain files in the web app’s main folder,” the advisories say.
An attacker sends a special URL that has directory traversal codes. The server gives back a file that it should keep private. This access to any file does not require a login or user action.
Affected Versions
All versions of each product are affected, including end-of-life releases. Atlassian lists these fixed versions:
Jira Data Center: 9.12.40, 10.3.26 or 11.3.12
Jira Service Management Data Center: 5.12.40, 10.3.26 or 11.3.12
Confluence Data Center: 9.2.26 or 10.2.19
Bitbucket Data Center: 9.4.26, 10.2.8 or 10.5.1
Bamboo Data Center: 10.2.24 or 12.1.12
Crowd Data Center: 6.3.7, 7.0.3, 7.1.7 or 7.2.4
Fisheye and Crucible: 4.9.15
Patch and Mitigation Steps
Upgrade to a stable version as soon as you can. Each product has its own notice: Jira Data Center, Confluence Data Center, Bitbucket Data Center, Bamboo Data Center, Crowd Data Center, Fisheye, and Crucible.
IBM Flaws
IBM released a security notice about 25 Langflow problems in Langflow OSS versions 1.0.0 to 1.12.2. Two issues, CVE-2026-104334 and CVE-2026-93674, have a score of 9.8 on CVSS 3.1 and allow an unauthorized attacker to run code. IBM advises users to update to Langflow 1.12.3.
How the Attacks Work
Unauthenticated Code Execution
CVE-2026-104334 stems from “improper control of code generation,” while CVE-2026-93674 involves “improper neutralization of special elements used in an OS command.” Both need no login and no user interaction.
A third flaw, CVE-2026-93675 (CVSS 8.8), abuses dependency confusion. It also needs no login, though a user must take an action.
Sandbox Escapes for Logged-In Users
Most other Langflow weaknesses focus on logged-in users. Some ignore the platform’s code security rules. For instance, CVE-2026-97655 goes around “an incomplete blocklist in the code security scanner.” CVE-2026-97676 allows a sandbox escape. Also, CVE-2026-93447 misuses cached Redis values, but it needs the server secret and Redis write access.
File Access and Data Leaks
Path traversal bugs let users access files outside of allowed folders. IBM says CVE-2026-97677 lets someone create files in any folder the service account can write to. It can also read important files like configuration files, secrets, or database files. Other bugs reveal passwords or mess up the vertex result cache. Lastly, CVE-2026-93679 causes the server to crash with large ZIP files.
Affected Versions
All 25 flaws affect Langflow OSS 1.0.0 through 1.12.2.
Patch and Mitigation Steps
Upgrade to Langflow 1.12.3 now. IBM “strongly suggests fixing the problem immediately.” You can find all the details in the IBM security bulletin for Langflow OSS. Until you upgrade, do not put Langflow on the public internet. Limit who can create or change flows, because most of these issues need an account. After fixing, change any API keys and passwords saved in the platform.
