CVE-2022-26136

CVE-2022-26136 is a vulnerability in multiple Atlassian products where remote, unauthenticated attackers can bypass Servlet Filters used by first and third‑party apps, potentially causing authentication bypass and XSS. Affected products and fixed ranges are provided: Atlassian Bamboo (<8.0.9, ...

CVE-2022-26137

CVE-2022-26137 concerns multiple Atlassian products (Bamboo, Bitbucket, Confluence, Jira, Jira Service Management, Crowd, Fisheye/Crucible) where an unauthenticated remote attacker can trigger additional Servlet Filters in requests/responses, causing a CORS bypass. The issue allows an attacker to...

CVE-2019-15005

The CVE-2019-15005 vulnerability concerns the Atlassian Troubleshooting and Support Tools (ATST) plugin prior to version 1.17.2, which is bundled with multiple Atlassian products. An unprivileged user can initiate periodic log scans and have the results emailed to a user-specified address due to ...

CVE-2023-22516

CVE-2023-22516 affects Atlassian Bamboo Data Center and Server versions 8.1.0 through 9.3.0. It is an authenticated remote code execution vulnerability with a CVSS v3.1 base score of 8.8 (vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and a CVSS v3.0 score of 8.5 (attack vector NETWORK, privileges ...

CVE-2024-21689

CVE-2024-21689 is a high-severity RCE in Atlassian Bamboo Data Center/Server, introduced in versions 9.1.0–9.6.0. An authenticated attacker can execute arbitrary code with high confidentiality, integrity, and availability impact, requiring user interaction. Public details indicate fixed upgrades:...

CVE-2021-26067

CVE-2021-26067 affects Atlassian Bamboo before 7.2.2, where an unauthenticated attacker can trigger a stack trace through the /chart endpoint, potentially exposing the home directory path and certain files in the tmp directory (Sensitive Data Exposure). The issue is rooted in the handling of the ...

CVE-2012-2926

CVE-2012-2926 covers multiple Atlassian products (JIRA <5.0.1; Confluence pre-3.5.16, 4.0.x <4.0.7, 4.1.x <4.1.10; FishEye/Crucible, Bamboo <3.3.4/3.4.x; Crowd <2.0.9, <2.1.2, <2.2.9, <2.3.7,

CVE-2015-6576

CVE-2015-6576 affects Atlassian Bamboo. Affected: Bamboo 2.2 prior to 5.8.5 and 5.9.x prior to 5.9.7. Root cause: an unspecified resource deserialization flaw in the web interface allows remote attackers with access to Bamboo to execute arbitrary Java code. Impact: remote code execution with the ...

CVE-2015-8360

CVE-2015-8360 affects Atlassian Bamboo pre-5.9.9 and 5.10.x pre-5.10.0, where deserializing untrusted data to the JMS port enables remote Java code execution via a deserialization vulnerability. The root cause is deserialization of arbitrary user input without proper restriction. Remediation per ...

CVE-2016-5229

CVE-2016-5229 affects Atlassian Bamboo prior to 5.11.4.1 and 5.12.x prior to 5.12.3.1. The issue arises from insufficient restriction of deserialized classes during XStream-based deserialization, enabling remote code execution via crafted input. A fix is available: Bamboo 5.12.3.1 and 5.11.4.1 (a...

CVE-2017-18081

Affected product: Atlassian Bamboo (signupUser resource). Vulnerable in versions before 6.3.1 due to a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary HTML/JavaScript via the csrf token cookie value. Impact is the ability to execute script in a victim’s browser, p...

CVE-2024-21687

CVE-2024-21687 affects Atlassian Bamboo Data Center and Server (versions 9.0.0–9.6.0). The issue is a file inclusion vulnerability that allows an authenticated attacker to view local files or execute locally stored files due to the underlying logic described in the report. Impact is high on confi...

CVE-2017-14589

CVE-2017-14589: Atlassian Bamboo is affected by a remote code execution issue caused by double OGNL evaluation in FreeMarker templates via Struts FreeMarker tags. Affected versions are Bamboo < 6.1.6 and 6.2.0 ≤ Bamboo

CVE-2014-9757

CVE-2014-9757 affects Atlassian Bamboo prior to 5.9.9 and 5.10.x prior to 5.10.0, due to a deserialization vulnerability in the Ignite Realtime Smack XMPP API used by Bamboo. Remote configured XMPP servers can send serialized data in XMPP messages to execute arbitrary Java code on Bamboo servers....

CVE-2017-14590

CVE-2017-14590 affects Atlassian Bamboo. The issue arises when Bamboo does not validate that a Mercurial branch name contains argument parameters, enabling an attacker with permissions to create/edit repositories or plans, or commit to a Mercurial repo used by a plan with branch detection, to exe...

CVE-2018-5224

CVE-2018-5224 affects Atlassian Bamboo on Windows. The issue arises from improper handling of Mercurial repository URIs, allowing an attacker with repository/plan permissions to execute arbitrary code on vulnerable Bamboo Windows hosts. Affected versions are Bamboo 2.7.0–6.3.2 and 6.4.0–6.4.1 on ...

CVE-2015-8361

Atlassian Bamboo is affected: multiple services expose without authentication in Bamboo versions before 5.9.9 and 5.10.x before 5.10.0, allowing remote attackers to obtain sensitive information, modify settings, or manage build agents via the JMS port. Root cause described across sources is lack ...

CVE-2017-8907

Atlassian Bamboo 5.x before 5.15.7 and 6.x before 6.0.1 are affected by CVE-2017-8907 due to an improper permission check for deployment projects. An authenticated attacker who can log in as a user without edit permission (and with an existing green build plan) can create a deployment project and...

CVE-2017-9514

CVE-2017-9514 affects Atlassian Bamboo. A REST endpoint could parse YAML and did not adequately restrict loaded classes, enabling an authenticated user to execute Java code on vulnerable Bamboo versions. Affected ranges: 6.0.x before 6.0.5, 6.1.x before 6.1.4, and 6.2.x before 6.2.1. Remediation ...

CVE-2017-18042

CVE-2017-18042 concerns Atlassian Bamboo prior to 6.3.1. The vulnerability is a CSRF in the update user administration resource, allowing remote attackers to modify user data, including passwords. Affected: Bamboo versions before 6.3.1. Root cause: CSRF in the update user admin endpoint. Impact: ...

CVE-2017-18040

The vulnerability CVE-2017-18040 affects Atlassian Bamboo prior to version 6.2.0, in the viewDeploymentVersionCommits resource. It enables remote attackers to perform cross-site scripting by injecting arbitrary HTML/JavaScript via the name of a release. The issue is documented across multiple sou...

CVE-2017-18041

An XSS vulnerability exists in Atlassian Bamboo before 6.2.0 in the viewDeploymentVersionJiraIssuesDialog resource, allowing remote attackers to inject arbitrary HTML/JavaScript via the release name. Affected: Bamboo

CVE-2017-18082

The CVE-2017-18082 vulnerability affects Atlassian Bamboo’s plan configure branches resource. Versions prior to 6.2.3 are vulnerable to a cross-site scripting (XSS) flaw that allows remote attackers to inject arbitrary HTML or JavaScript via the name of a branch. Mitigation: upgrade Bamboo to 6.2...

CVE-2017-18080

Atlassian Bamboo contains a CSRF vulnerability in the saveConfigureSecurity resource, affecting versions before 6.3.1. The issue allows remote attackers to modify security settings. Remediation: upgrade to Bamboo 6.3.1 or later (no other mitigations detailed in the provided docs).

CVE-2026-21584

CVE-2026-21584 is an Improper Authorization vulnerability in Atlassian Bamboo Data Center , affecting versions 10.0.0 through 12.1.0. An authenticated attacker with low privileges can gain unintended access to resources or functionality over the network, potentially leading to exposure of sensiti...

CVE-2026-21570

The CVE-2026-21570 entry describes a high-severity remote code execution in Atlassian Bamboo Data Center. Affected releases include 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, and 12.1.0. An authenticated attacker can execute code on the remote system (CVSS v4.0 base score 8.6, attack ...

CVE-2026-21571

Bamboo Data Center is affected by CVE-2026-21571, a critical OS Command Injection that allows an authenticated attacker to execute remote commands. The vulnerability was introduced in versions 9.6.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0 and 12.1.0. It has a CVSS v4 base score of 9.4, wi...