Read the docs
TI-2022-09598 Aliases CVE-2022-26136GHSA-f3mv-w3v5-88qp

Improper authentication in Atlassian Bamboo Server

Priority MEDIUM 57CWE-180Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-287.

Summary

A vulnerability in multiple Atlassian products allows a remote, unauthenticated attacker to bypass Servlet Filters used by first and third party apps. The impact depends on which filters are used by each app, and how the filters are used. This vulnerability can result in authentication bypass and cross-site scripting. Atlassian has released updates that fix the root cause of this vulnerability, but has not exhaustively enumerated all potential consequences of this vulnerability. Atlassian Bamboo versions are affected before 8.0.9, from 8.1.0 before 8.1.8, and from 8.2.0 before 8.2.4. Atlassian Bitbucket versions are affected before 7.6.16, from 7.7.0 before 7.17.8, from 7.18.0 before 7.19.5, from 7.20.0 before 7.20.2, from 7.21.0 before 7.21.2, and versions 8.0.0 and 8.1.0. Atlassian Confluence versions are affected before 7.4.17, from 7.5.0 before 7.13.7, from 7.14.0 before 7.14.3, from 7.15.0 before 7.15.2, from 7.16.0 before 7.16.4, from 7.17.0 before 7.17.4, and version 7.21.0. Atlassian Crowd versions are affected before 4.3.8, from 4.4.0 before 4.4.2, and version 5.0.0. Atlassian Fisheye and Crucible versions before 4.8.10 are affected. Atlassian Jira versions are affected before 8.13.22, from 8.14.0 before 8.20.10, and from 8.21.0 before 8.22.4. Atlassian Jira Service Management versions are affected before 4.13.22, from 4.14.0 before 4.20.10, and from 4.21.0 before 4.22.4.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.05662 93rd percentileScored 2026-11-07
Fix Fixed Bamboo Server (Atlassian): 8.0.9, 8.1.8, 8.2.4Bamboo Data Center (Atlassian): 8.0.9, 8.1.8, 8.2.4+13 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AtlassianBamboo Serverbefore 8.0.9; 8.1.0 and later; before 8.1.8; 8.2.0 and later; before 8.2.48.0.9, 8.1.8, 8.2.4Patch availableCNA
AtlassianBamboo Data Centerbefore 8.0.9; 8.1.0 and later; before 8.1.8; 8.2.0 and later; before 8.2.48.0.9, 8.1.8, 8.2.4Patch availableCNA
AtlassianBitbucket Serverbefore 7.6.16; 7.7.0 and later; 7.16.0 and later; before 7.17.8; 7.18.0 and later; before 7.19.5; 7.20.0 and later; before 7.20.2; 7.21.0 and later; before 7.21.2; 8.0.0; 8.1.07.6.16, 7.17.8, 7.19.5, 7.20.2, 7.21.2Patch availableCNA
AtlassianBitbucket Data Centerbefore 7.6.16; 7.7.0 and later; 7.16.0 and later; before 7.17.8; 7.18.0 and later; before 7.19.5; 7.20.0 and later; before 7.20.2; 7.21.0 and later; before 7.21.2; 8.0.0; 8.1.07.6.16, 7.17.8, 7.19.5, 7.20.2, 7.21.2Patch availableCNA
AtlassianConfluence Serverbefore 7.4.17; 7.5.0 and later; before 7.13.7; 7.14.0 and later; before 7.14.3; 7.15.0 and later; before 7.15.2; 7.16.0 and later; before 7.16.4; 7.17.0 and later; before 7.17.4; 7.18.07.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4Patch availableCNA
AtlassianConfluence Data Centerbefore 7.4.17; 7.5.0 and later; before 7.13.7; 7.14.0 and later; before 7.14.3; 7.15.0 and later; before 7.15.2; 7.16.0 and later; before 7.16.4; 7.17.0 and later; before 7.17.4; 7.18.07.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4Patch availableCNA
AtlassianCrowd Serverbefore 4.3.8; 4.4.0 and later; before 4.4.2; 5.0.04.3.8, 4.4.2Patch availableCNA
AtlassianCrowd Data Centerbefore 4.3.8; 4.4.0 and later; before 4.4.2; 5.0.04.3.8, 4.4.2Patch availableCNA
AtlassianCruciblebefore 4.8.104.8.10Patch availableCNA
AtlassianFisheyebefore 4.8.104.8.10Patch availableCNA
AtlassianJira Core Serverbefore 8.13.22; 8.14.0 and later; before 8.20.10; 8.21.0 and later; before 8.22.48.13.22, 8.20.10, 8.22.4Patch availableCNA
AtlassianJira Software Serverbefore 8.13.22; 8.14.0 and later; before 8.20.10; 8.21.0 and later; before 8.22.48.13.22, 8.20.10, 8.22.4Patch availableCNA
AtlassianJira Software Data Centerbefore 8.13.22; 8.14.0 and later; before 8.20.10; 8.21.0 and later; before 8.22.48.13.22, 8.20.10, 8.22.4Patch availableCNA
AtlassianJira Service Management Serverbefore 4.13.22; 4.14.0 and later; before 4.20.10; 4.21.0 and later; before 4.22.44.13.22, 4.20.10, 4.22.4Patch availableCNA
AtlassianJira Service Management Data Centerbefore 4.13.22; 4.14.0 and later; before 4.20.10; 4.21.0 and later; before 4.22.44.13.22, 4.20.10, 4.22.4Patch availableCNA
  • Bamboo Server VendorAtlassian Affected before 8.0.9; 8.1.0 and later; before 8.1.8; 8.2.0 and later; before 8.2.4 Fixed in 8.0.9, 8.1.8, 8.2.4 Patch available CNA
  • Bamboo Data Center VendorAtlassian Affected before 8.0.9; 8.1.0 and later; before 8.1.8; 8.2.0 and later; before 8.2.4 Fixed in 8.0.9, 8.1.8, 8.2.4 Patch available CNA
  • Bitbucket Server VendorAtlassian Affected before 7.6.16; 7.7.0 and later; 7.16.0 and later; before 7.17.8; 7.18.0 and later; before 7.19.5; 7.20.0 and later; before 7.20.2; 7.21.0 and later; before 7.21.2; 8.0.0; 8.1.0 Fixed in 7.6.16, 7.17.8, 7.19.5, 7.20.2, 7.21.2 Patch available CNA
  • Bitbucket Data Center VendorAtlassian Affected before 7.6.16; 7.7.0 and later; 7.16.0 and later; before 7.17.8; 7.18.0 and later; before 7.19.5; 7.20.0 and later; before 7.20.2; 7.21.0 and later; before 7.21.2; 8.0.0; 8.1.0 Fixed in 7.6.16, 7.17.8, 7.19.5, 7.20.2, 7.21.2 Patch available CNA
  • Confluence Server VendorAtlassian Affected before 7.4.17; 7.5.0 and later; before 7.13.7; 7.14.0 and later; before 7.14.3; 7.15.0 and later; before 7.15.2; 7.16.0 and later; before 7.16.4; 7.17.0 and later; before 7.17.4; 7.18.0 Fixed in 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4 Patch available CNA
  • Confluence Data Center VendorAtlassian Affected before 7.4.17; 7.5.0 and later; before 7.13.7; 7.14.0 and later; before 7.14.3; 7.15.0 and later; before 7.15.2; 7.16.0 and later; before 7.16.4; 7.17.0 and later; before 7.17.4; 7.18.0 Fixed in 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4 Patch available CNA
  • Crowd Server VendorAtlassian Affected before 4.3.8; 4.4.0 and later; before 4.4.2; 5.0.0 Fixed in 4.3.8, 4.4.2 Patch available CNA
  • Crowd Data Center VendorAtlassian Affected before 4.3.8; 4.4.0 and later; before 4.4.2; 5.0.0 Fixed in 4.3.8, 4.4.2 Patch available CNA
  • Crucible VendorAtlassian Affected before 4.8.10 Fixed in 4.8.10 Patch available CNA
  • Fisheye VendorAtlassian Affected before 4.8.10 Fixed in 4.8.10 Patch available CNA
  • Jira Core Server VendorAtlassian Affected before 8.13.22; 8.14.0 and later; before 8.20.10; 8.21.0 and later; before 8.22.4 Fixed in 8.13.22, 8.20.10, 8.22.4 Patch available CNA
  • Jira Software Server VendorAtlassian Affected before 8.13.22; 8.14.0 and later; before 8.20.10; 8.21.0 and later; before 8.22.4 Fixed in 8.13.22, 8.20.10, 8.22.4 Patch available CNA
  • Jira Software Data Center VendorAtlassian Affected before 8.13.22; 8.14.0 and later; before 8.20.10; 8.21.0 and later; before 8.22.4 Fixed in 8.13.22, 8.20.10, 8.22.4 Patch available CNA
  • Jira Service Management Server VendorAtlassian Affected before 4.13.22; 4.14.0 and later; before 4.20.10; 4.21.0 and later; before 4.22.4 Fixed in 4.13.22, 4.20.10, 4.22.4 Patch available CNA
  • Jira Service Management Data Center VendorAtlassian Affected before 4.13.22; 4.14.0 and later; before 4.20.10; 4.21.0 and later; before 4.22.4 Fixed in 4.13.22, 4.20.10, 4.22.4 Patch available CNA

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:*7.2.0 to before 7.2.10; 8.0.0 to before 8.0.9; 8.1.0 to before 8.1.8; 8.2.0 to before 8.2.4VulnerableAtlassian
cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:*before 7.6.16; 7.7.0 to before 7.17.8; 7.18.0 to before 7.19.5; 7.20.0 to before 7.20.2; 7.21.0 to before 7.21.2VulnerableAtlassian
cpe:2.3:a:atlassian:bitbucket:8.0.0:*:*:*:*:*:*:*8.0.0VulnerableAtlassian
cpe:2.3:a:atlassian:bitbucket:8.1.0:*:*:*:*:*:*:*8.1.0VulnerableAtlassian
cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:*before 7.4.17; 7.5.0 to before 7.13.7; 7.14.0 to before 7.14.3; 7.15.0 to before 7.15.2; 7.16.0 to before 7.16.4; 7.17.0 to before 7.17.4VulnerableAtlassian
cpe:2.3:a:atlassian:confluence_data_center:7.18.0:*:*:*:*:*:*:*7.18.0VulnerableAtlassian
cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:*before 7.4.17; 7.5.0 to before 7.13.7; 7.14.0 to before 7.14.3; 7.15.0 to before 7.15.2; 7.16.0 to before 7.16.4; 7.17.0 to before 7.17.4VulnerableAtlassian
cpe:2.3:a:atlassian:confluence_server:7.18.0:*:*:*:*:*:*:*7.18.0VulnerableAtlassian
cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:*before 4.3.8; 4.4.0 to before 4.4.2VulnerableAtlassian
cpe:2.3:a:atlassian:crowd:5.0.0:*:*:*:*:*:*:*5.0.0VulnerableAtlassian
  • cpe:2.3:a:atlassian:bamboo:*:*:*:*:*:*:*:* Versions 7.2.0 to before 7.2.10; 8.0.0 to before 8.0.9; 8.1.0 to before 8.1.8; 8.2.0 to before 8.2.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bitbucket:*:*:*:*:*:*:*:* Versions before 7.6.16; 7.7.0 to before 7.17.8; 7.18.0 to before 7.19.5; 7.20.0 to before 7.20.2; 7.21.0 to before 7.21.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bitbucket:8.0.0:*:*:*:*:*:*:* Versions 8.0.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:bitbucket:8.1.0:*:*:*:*:*:*:* Versions 8.1.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:confluence_data_center:*:*:*:*:*:*:*:* Versions before 7.4.17; 7.5.0 to before 7.13.7; 7.14.0 to before 7.14.3; 7.15.0 to before 7.15.2; 7.16.0 to before 7.16.4; 7.17.0 to before 7.17.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:confluence_data_center:7.18.0:*:*:*:*:*:*:* Versions 7.18.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:confluence_server:*:*:*:*:*:*:*:* Versions before 7.4.17; 7.5.0 to before 7.13.7; 7.14.0 to before 7.14.3; 7.15.0 to before 7.15.2; 7.16.0 to before 7.16.4; 7.17.0 to before 7.17.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:confluence_server:7.18.0:*:*:*:*:*:*:* Versions 7.18.0 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:crowd:*:*:*:*:*:*:*:* Versions before 4.3.8; 4.4.0 to before 4.4.2 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:crowd:5.0.0:*:*:*:*:*:*:* Versions 5.0.0 Vulnerable ·Atlassian
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*before 4.8.10VulnerableAtlassian
cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:*before 4.8.10VulnerableAtlassian
cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:*8.13.0 to before 8.13.22; 8.14.0 to before 8.20.10; 8.21.0 to before 8.22.4VulnerableAtlassian
cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:*8.13.0 to before 8.13.22; 8.14.0 to before 8.20.10; 8.21.0 to before 8.22.4VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:*before 4.13.22VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:*before 4.13.22VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*4.14.0 to before 4.20.10VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*4.14.0 to before 4.20.10VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*4.21.0 to before 4.22.4VulnerableAtlassian
cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:*4.21.0 to before 4.22.4VulnerableAtlassian
  • cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:* Versions before 4.8.10 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:* Versions before 4.8.10 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_data_center:*:*:*:*:*:*:*:* Versions 8.13.0 to before 8.13.22; 8.14.0 to before 8.20.10; 8.21.0 to before 8.22.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_server:*:*:*:*:*:*:*:* Versions 8.13.0 to before 8.13.22; 8.14.0 to before 8.20.10; 8.21.0 to before 8.22.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:data_center:*:*:* Versions before 4.13.22 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_desk:*:*:*:*:server:*:*:* Versions before 4.13.22 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* Versions 4.14.0 to before 4.20.10 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* Versions 4.14.0 to before 4.20.10 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:* Versions 4.21.0 to before 4.22.4 Vulnerable ·Atlassian
  • cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:server:*:*:* Versions 4.21.0 to before 4.22.4 Vulnerable ·Atlassian

Remediation

  • Fix · CNA Bamboo Server (Atlassian) Fixed in 8.0.9, 8.1.8, 8.2.4
  • Fix · CNA Bamboo Data Center (Atlassian) Fixed in 8.0.9, 8.1.8, 8.2.4
  • Fix · CNA Bitbucket Server (Atlassian) Fixed in 7.6.16, 7.17.8, 7.19.5, 7.20.2, 7.21.2
  • Fix · CNA Bitbucket Data Center (Atlassian) Fixed in 7.6.16, 7.17.8, 7.19.5, 7.20.2, 7.21.2
  • Fix · CNA Confluence Server (Atlassian) Fixed in 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4
  • Fix · CNA Confluence Data Center (Atlassian) Fixed in 7.4.17, 7.13.7, 7.14.3, 7.15.2, 7.16.4, 7.17.4
  • Fix · CNA Crowd Server (Atlassian) Fixed in 4.3.8, 4.4.2
  • Fix · CNA Crowd Data Center (Atlassian) Fixed in 4.3.8, 4.4.2
  • Fix · CNA Crucible (Atlassian) Fixed in 4.8.10
  • Fix · CNA Fisheye (Atlassian) Fixed in 4.8.10
  • Fix · CNA Jira Core Server (Atlassian) Fixed in 8.13.22, 8.20.10, 8.22.4
  • Fix · CNA Jira Software Server (Atlassian) Fixed in 8.13.22, 8.20.10, 8.22.4
  • Fix · CNA Jira Software Data Center (Atlassian) Fixed in 8.13.22, 8.20.10, 8.22.4
  • Fix · CNA Jira Service Management Server (Atlassian) Fixed in 4.13.22, 4.20.10, 4.22.4
  • Fix · CNA Jira Service Management Data Center (Atlassian) Fixed in 4.13.22, 4.20.10, 4.22.4

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    Atlassian Bamboo Data Center, Bamboo Server and 13 more products 4.13.22, 4.20.10 and 22 more versions

    2 records Highest priority Priority MEDIUM 2 MEDIUM

    Other records, highest priority first

    • TI-2022-09599 Origin validation error in Atlassian Bamboo ServerPriority MEDIUM 45
    Show all 2 records →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-26136
  2. 2026-10-03 Alias added: GHSA-f3mv-w3v5-88qp

References

Patch 8

  • TI-2026-67904 Arbitrary file access in Atlassian Data Center products KEVCVSS 4.0CRITICAL 9.3
  • TI-2012-02540 Atlassian JIRA before 5.0.1; Confluence before 3.5.16, 4.0 before 4.0.7, and 4.1 before… CVSS 3.1CRITICAL 9.1
  • TI-2016-04529 Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict… CVSS 3.0CRITICAL 9.8
  • TI-2015-06881 An unspecified resource in Atlassian Bamboo before 5.9.9 and 5.10.x before 5.10.0 allows… CVSS 3.0CRITICAL 9.8
  • TI-2014-07936 The Ignite Realtime Smack XMPP API, as used in Atlassian Bamboo before 5.9.9 and 5.10.x… CVSS 3.0CRITICAL 9.8
  • TI-2026-17399 Code injection in Atlassian Bamboo Data Center CVSS 4.0HIGH 8.6
See all 27 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences