Update as of October 21, 2026:
Hi everyone,
Earlier this year, we shared our initial Changelog announcement about the upcoming change to Bitbucket Cloud SSH access. This is an important change to improve Bitbucket’s security posture and safeguard our customers from denial of service abuse. After receiving some feedback from our customers, we have decided extend a grace period starting from the original deprecation date: November 12, 2026 to December 10, 2026. During this time, we will run a series of controlled brownouts to help teams identify and migrate any remaining usage ahead of the December 10, 2026.
During each brownout window, we will:
- Temporarily block SSH traffic on bitbucket.org
- Return clear error messages
- Show in-product messaging wherever possible
Brownout schedule:
Please note that we are excluding weekends and holidays from this brownout schedule to avoid any disruptions during down times.
Dates | Brownout duration per window | Brownout window start times (UTC) |
|---|
Nov 12, 2026 | 15 minutes | 00:00 |
Nov 12, 2026 | 15 minutes | 06:00 |
Nov 12, 2026 | 15 minutes | 12:00 |
Nov 12, 2026 | 15 minutes | 18:00 |
Nov 13, 2026 | 15 minutes | 00:00 |
Nov 13, 2026 | 15 minutes | 06:00 |
Nov 13, 2026 | 15 minutes | 12:00 |
Nov 13, 2026 | 15 minutes | 18:00 |
Nov 16, 2026 | 30 minutes | 00:00 |
Nov 16, 2026 | 30 minutes | 06:00 |
Nov 16, 2026 | 30 minutes | 12:00 |
Nov 16, 2026 | 30 minutes | 18:00 |
Nov 17, 2026 | 30 minutes | 00:00 |
Nov 17, 2026 | 30 minutes | 06:00 |
Nov 17, 2026 | 30 minutes | 12:00 |
Nov 17, 2026 | 30 minutes | 18:00 |
Nov 18, 2026 | 30 minutes | 00:00 |
Nov 18, 2026 | 30 minutes | 06:00 |
Nov 18, 2026 | 30 minutes | 12:00 |
Nov 18, 2026 | 30 minutes | 18:00 |
Nov 19, 2026 | 30 minutes | 00:00 |
Nov 19, 2026 | 30 minutes | 06:00 |
Nov 19, 2026 | 30 minutes | 12:00 |
Nov 19, 2026 | 30 minutes | 18:00 |
Nov 20, 2026 | 30 minutes | 00:00 |
Nov 20, 2026 | 30 minutes | 06:00 |
Nov 20, 2026 | 30 minutes | 12:00 |
Nov 20, 2026 | 30 minutes | 18:00 |
Nov 23, 2026 | 1 hour | 00:00 |
Nov 23, 2026 | 1 hour | 06:00 |
Nov 23, 2026 | 1 hour | 12:00 |
Nov 23, 2026 | 1 hour | 18:00 |
Nov 24, 2026 | 1 hour | 00:00 |
Nov 24, 2026 | 1 hour | 06:00 |
Nov 24, 2026 | 1 hour | 12:00 |
Nov 24, 2026 | 1 hour | 18:00 |
Nov 30, 2026 | 2 hours | 00:00 |
Nov 30, 2026 | 2 hours | 06:00 |
Nov 30, 2026 | 2 hours | 12:00 |
Nov 30, 2026 | 2 hours | 18:00 |
Dec 1, 2026 | 2 hours | 00:00 |
Dec 1, 2026 | 2 hours | 06:00 |
Dec 1, 2026 | 2 hours | 12:00 |
Dec 1, 2026 | 2 hours | 18:00 |
Dec 2, 2026 | 2 hours | 00:00 |
Dec 2, 2026 | 2 hours | 06:00 |
Dec 2, 2026 | 2 hours | 12:00 |
Dec 2, 2026 | 2 hours | 18:00 |
Dec 3, 2026 | 3 hours | 00:00 |
Dec 3, 2026 | 3 hours | 06:00 |
Dec 3, 2026 | 3 hours | 12:00 |
Dec 3, 2026 | 3 hours | 18:00 |
Dec 4, 2026 | 3 hours | 00:00 |
Dec 4, 2026 | 3 hours | 06:00 |
Dec 4, 2026 | 3 hours | 12:00 |
Dec 4, 2026 | 3 hours | 18:00 |
Dec 7, 2026 | 3 hours | 00:00 |
Dec 7, 2026 | 3 hours | 06:00 |
Dec 7, 2026 | 3 hours | 12:00 |
Dec 7, 2026 | 3 hours | 18:00 |
Dec 8, 2026 | 3 hours | 00:00 |
Dec 8, 2026 | 3 hours | 06:00 |
Dec 8, 2026 | 3 hours | 12:00 |
Dec 8, 2026 | 3 hours | 18:00 |
Dec 9, 2026 | 3 hours | 00:00 |
Dec 9, 2026 | 3 hours | 06:00 |
Dec 9, 2026 | 3 hours | 12:00 |
Dec 9, 2026 | 3 hours | 18:00 |
Dec 10, 2026 | Final removal | |
Note:
We continue to use the same SSH host keys as before with the new SSH hostname. To ensure that you can trust these host keys, we are specifying those here for your reference.
SHA256 format
256 SHA256:FC73VB6C4OQLSCrjEayhMp9UMxS97caD/Yyi2bhW/J0 bitbucket.org (ECDSA)
256 SHA256:ybgmFkzwOSotHTHLJgHO0QN8L0xErw6vd0VhFA9m3SM bitbucket.org (ED25519)
2048 SHA256:46OSHA1Rmj8E8ERTC6xkNcmGOw9oFxYr0WF6zWW8l1E bitbucket.org (RSA)
Original announcement:
As part of our security and anti-abuse posture, we are making an important change to how SSH traffic is handled for Bitbucket Cloud. If you use Git over SSH with Bitbucket today, you’ll need to update your configuration by November 12, 2026 to avoid disruption.
What’s changing?
Bitbucket Cloud is separating SSH and HTTPS traffic so that:
bitbucket.org will serve only HTTPS traffic (web and API)- All SSH-based Git operations must use a new hostname:
ssh.bitbucket.org
This change affects Git over SSH only. Common SSH operations that will be impacted include:
git clone (over SSH)git pullgit fetchgit push
If you currently use SSH URLs that look like:
git@bitbucket.org:<workspace>/<repo>.git
you’ll need to update them to use:
git@ssh.bitbucket.org:<workspace>/<repo>.git
HTTPS access is not affected. URLs such as:
https://bitbucket.org/<workspace>/<repo>.git
will continue to work as they do today.
Why we are making this change
By splitting SSH and HTTPS traffic onto separate hostnames, we can:
- Apply more advanced and tailored security protections specifically to Bitbucket’s public web and API endpoints (
bitbucket.org) - Better isolate different types of traffic, improving resilience and scalability over time
- Reduce the blast radius of certain classes of attacks by separating protocols
In short, this is part of ongoing work to harden Bitbucket Cloud’s security posture and improve reliability for all customers.
What you need to do
If you use Git over SSH with Bitbucket Cloud, you’ll need to:
1. Update SSH remote URLs
For each repository that currently uses an SSH remote pointing at bitbucket.org, update the remote URL to use ssh.bitbucket.org instead.
From within your local clone:
git remote set-url origin git@ssh.bitbucket.org:<workspace>/<repo>.git
Repeat this for each remote or repository that uses SSH and bitbucket.org.
You can confirm your current remote configuration with:
git remote -v
Look for any entries that include git@bitbucket.org: and update them.
2. Trust the new SSH host key
The first time you connect to ssh.bitbucket.org, you’ll be prompted to verify and accept its SSH host key. When you see the prompt, review the fingerprint and, if it matches Bitbucket’s published values, choose “yes” to continue. This will add the host key to your ~/.ssh/known_hosts file.
If you prefer to pre-seed your known_hosts file (for example, in automated environments), you can manually add the ssh.bitbucket.org host key there in advance.
You can use the following command in the automation to add the host keys of the new server:
curl -s https://bitbucket.org/site/ssh | sed 's/bitbucket.org/ssh.bitbucket.org/' >> ~/.ssh/known_hosts
3. Update CI/CD pipelines and automation
Any automated system that uses SSH to interact with Bitbucket Cloud will also need to be updated. This includes:
- CI/CD pipelines
- Deployment scripts
- Build servers
- Mirroring/synchronization jobs
- Any internal tooling that runs
git clone, git fetch, or git push over SSH
Search your configuration for git@bitbucket.org: or ssh://git@bitbucket.org and update those references to git@ssh.bitbucket.org:.
4. Adjust network/firewall rules if needed
If your organization restricts outbound SSH connections via firewalls or security appliances, ensure that ssh.bitbucket.org on port 22 is allowlisted.
You may need to:
- Add
ssh.bitbucket.org to your outbound allowlist - Update any hostname-based rules that currently reference
bitbucket.org for SSH - Coordinate with your network/security team to roll out the change across environments
If your network blocks port 22, Bitbucket provides an alternate hostname and port combination you can use. Follow the directions at Port 22 is blocked on local network | Bitbucket Cloud | Atlassian Support.
Timeline
This change is being announced now, and customers will have until November 12, 2026 to complete their migration.
- During this migration window, SSH access via
bitbucket.org will continue to work, but you should start updating to the new SSH server ssh.bitbucket.org as soon as possible. - After the migration period ends on November 12, 2026 , SSH connections to
bitbucket.org will be refused. At that point, any Git operations over SSH that still target bitbucket.org will fail until they are updated to use ssh.bitbucket.org.
We encourage you to complete these updates well before November 12, 2026 to avoid last-minute issues.
Need help?
If you have questions about this change, run into issues updating your remotes, or need guidance for complex/large-scale environments:
- Comment on this post with details of your setup
- Or contact Atlassian Support via your standard support channels
We’ll monitor feedback and update this post with any additional clarifications or common troubleshooting tips as needed.