CVE-2026-21584: bamboo from 10.0.0 (inclusive), before 10.2.22 (exclusive), from 11.0.0 (inclusive), before 12.1.10 (exclusive); +1…

Affected technology

bamboo · from 10.0.0 (inclusive), before 10.2.22 (exclusive)
atlassian

bamboo · from 11.0.0 (inclusive), before 12.1.10 (exclusive)
atlassian

Bamboo Data Center · 12.1.0 to 12.1.9, 12.0.0 to 12.0.2, 11.0.0 to 11.0.8, 10.2.0 to 10.2.21, 10.1.0 to 10.1.1, 10.0.0 to 10.0.3
Atlassian

Description’s affected range: versions 10.0.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

An authenticated attacker can gain unintended access and can lead to the exposure of resources or functionality, possibly providing attackers with sensitive information or even execute arbitrary code. Vendor/CNA’s CVSS 4.0 assessment (base score 7.6/10) rates confidentiality and integrity impact as high; availability impact as none.