Bamboo Data Center CVE-2026-21584

Exploitation requires a valid Bamboo Data Center account with at minimum low-level privileges (PR:L per CVSS 4.0). The CVSS 4.0 Attack Requirements metric is set to AT:P (Present), meaning a specific deployment-side condition must be satisfied - but Atlassian has not publicly disclosed what feature, configuration mode, or project type triggers the vulnerable code path. The attack is network-reachable with no user interaction required. What limits exploitation: the attacker must already be authenticated to the Bamboo instance; unauthenticated external attackers cannot exploit this directly. The AT:P constraint further narrows the population of exploitable instances, though without vendor clarification defenders cannot confirm whether their specific deployment meets the required condition. No special platform (OS/cloud) requirements are stated.

The CVSS 4.0 score of 7.6 (High) is substantiated by a network attack vector, no user interaction requirement, and high confidentiality and integrity impacts on the vulnerable system - characteristics that translate to meaningful real-world risk in enterprise CI/CD environments; even a mid-sized municipal IT team in Malbork running Bamboo Data Center to automate infrastructure deployments should treat this as an urgent upgrade cycle, given that low-privilege Bamboo accounts are often granted to developers or contractors who are not trusted with production secrets. The AT:P metric (Attack Requirements: Present) in CVSS 4.0 tempers the risk somewhat compared to a fully generic network exploit, because some specific precondition must be satisfied - but Atlassian has not disclosed what that condition is, making it difficult for defenders to assess whether their configuration is exploitable without upgrading. There is no EPSS score available, and the absence of a CISA KEV listing and the pen-test discovery origin both suggest this is not yet being exploited in the wild, though the gap between disclosure and weaponization is historically narrow for Atlassian products. The RCE tag is a significant escalation signal - if the integrity path leads to code execution on the Bamboo server, which typically runs with broad system-level credentials, the blast radius extends well beyond the application tier.

An attacker holding a low-privilege Bamboo Data Center account - such as a developer or CI agent service account - crafts a network request that triggers the improper authorization path, bypassing permission checks to access a restricted Bamboo resource or API endpoint. If the integrity path leads to arbitrary code execution as tagged, the attacker could modify build plans, inject malicious steps into pipelines, or extract deployment credentials and repository secrets stored in Bamboo's configuration. No public proof-of-concept code has been identified at time of analysis, but the pen-test origin confirms the attack path is concretely reproducible.