Bamboo Data Center CVE-2026-21571

Requires authentication with any valid Bamboo Data Center user account-low-privilege user access is sufficient (PR:L), administrative roles are NOT required. The vulnerable feature accepting command injection input must be accessible to the authenticated user role, which per the UI:N (no user interaction) and AC:L (low complexity) metrics suggests the vulnerable code path is in standard Bamboo functionality available to typical developer/builder accounts, not obscure administrative features. Exploitation succeeds against default Bamboo Data Center installations running affected versions 9.6.0-12.1.5 without additional configuration requirements. Factors limiting exploitation: authentication barrier prevents completely unauthenticated remote attacks; network access to Bamboo instance required (typically TCP 8085 or custom ports); organizations with strong credential hygiene, MFA enforcement, and IP allowlisting reduce credential compromise risk; Bamboo Cloud and non-Data Center Server editions are NOT vulnerable, limiting scope to self-hosted enterprise clustered deployments.

This represents critical real-world risk despite requiring authentication (PR:L). The CVSS 9.4 score accurately reflects severe impact: network-exploitable (AV:N), low complexity (AC:L), no attack technique variation required (AT:N), and catastrophic cross-scope impact. The authenticated requirement is a meaningful but limited barrier-Bamboo instances typically have many user accounts (developers, automated build systems, integration service accounts), and compromised credentials or insider threats provide trivial access. The cross-scope impact metrics suggest container escape or privilege escalation capabilities, making this more dangerous than typical application-layer RCE. No EPSS score provided, but command injection vulnerabilities in enterprise CI/CD platforms historically attract rapid exploitation due to high-value targets (source code, deployment credentials, production access). Absence from CISA KEV and no confirmed public POC at time of analysis suggests exploitation has not yet become widespread, providing a window for proactive patching. The attack vector complexity (AC:L) and no user interaction (UI:N) mean exploitation is trivially automatable once credentials are obtained. Priority should be highest for internet-exposed Bamboo instances, those with broad user bases, or environments where least-privilege user account controls are weak.

An attacker obtains valid low-privilege Bamboo user credentials through phishing, credential stuffing, or compromised service account tokens. They authenticate to the Bamboo Data Center web interface and navigate to a vulnerable feature that accepts user input processed by the command injection flaw. By crafting a malicious payload containing shell metacharacters and OS commands within an HTTP request parameter or form field, the attacker injects arbitrary commands that execute with the privileges of the Bamboo service process. Upon successful injection, the attacker executes commands to establish a reverse shell, escalate privileges to root if the cross-scope impact allows container escape, exfiltrate source code repositories, steal CI/CD secrets and deployment credentials stored in Bamboo, or pivot laterally to connected systems in the build infrastructure.