One Flaw, Eight Products: Atlassian's Critical Pre-Auth File Read (CVE-2026-21589)
CVE-2026-21589 is an unauthenticated arbitrary file-read flaw in a web-resource library shared by eight self-hosted Atlassian products, and it can escalate to Jira administrator in Crowd setups.
Summary
- First seen
- October 2026
- Affected products
- Atlassian Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye
CVE-2026-21589 is a critical, unauthenticated file-read flaw in eight self-hosted Atlassian products: Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, and Crowd Data Center, plus Crucible and Fisheye. Every version is affected. An attacker who knows a file's exact name and path can read it remotely, though they cannot browse or list folders. The bug sits in a shared web-resource library that turns double colons ("::") into slashes, letting a crafted request slip past the usual path checks. It gets worse in Crowd setups: attackers can read the plaintext crowd.properties file, use those credentials to reach Atlassian's identity hub, and create an admin account, turning a simple file read into full Jira admin. Atlassian's Cloud is already fixed with no sign of attacks, but self-hosted customers are exposed.
Vulnerability Details
CVE-2026-21589 is a critical weakness that runs across several Atlassian product families, Jira, Confluence, and Bitbucket among them, and is categorized under CWE-552 (Files or Directories Accessible to External Parties). The one meaningful constraint is that an attacker must already know the exact name and path of the file they want, because the vulnerability cannot enumerate or list directory contents on its own.
The underlying defect lives in a web-resource library shared across the affected products, identified by researchers as atlassian-plugins-webresource (vulnerable in 6.0.7 and fixed in 6.0.8). Inside this library, routing helper functions convert double colons ("::") into forward slashes ("/") while handling resource requests. A deprecated but still-active routine that builds a resource path relative to a web resource can then be reached through crafted input, and its slash-stripping protections are effectively bypassed by a traversal primitive shaped like ..::..::. The resulting path is ultimately handed to the resource factory, which reads the targeted local file and returns its contents to the attacker.
In practice, the attacker abuses a legitimate plugin resource route to reach this sink. For example, a Jira color-picker download route can be combined with the traversal primitive to retrieve the normally protected WEB-INF/web.xml, and equivalent routes exist for Confluence and Bitbucket. The read is confined to the Tomcat application context rather than the entire filesystem, but any file within the web root is fair game. The impact becomes critical in Crowd-integrated setups, where WEB-INF/classes/crowd.properties stores the Crowd application name and password in plaintext; with those credentials, and network reachability to Crowd, an attacker can authenticate to the identity service, create a user through its REST API, and add that user to jira-administrators. Crowd's IP allowlisting can make this direct path considerably harder.
All versions of the eight listed products are affected before the fixed releases, including unsupported versions, while Atlassian Cloud has already been remediated with no evidence of exploitation. Exploitation is already underway: after Atlassian's out-of-band advisory on October 5, 2026, and a detailed technical analysis on October 6, honeypot operators observed probing and exploitation attempts within about two hours of publication, aided by a public verification script and a released Nuclei template. Because detailed proof-of-concept material is public, vendors are recommending emergency, out-of-band patching and a review of access logs for signs of attempted exploitation.
Affected products and CVEs
| CVE ID | Affected products | Affected CPE | CWE ID |
|---|---|---|---|
| CVE-2026-21589 | Bitbucket DC before 9.4.26 / 10.2.8 / 10.5.1; Confluence DC before 9.2.26 / 10.2.19; Jira Service Management DC before 5.12.40 / 10.3.26 / 11.3.12; Jira Software DC before 9.12.40 / 10.3.26 / 11.3.12; Bamboo DC before 10.2.24 / 12.1.12; Crowd DC before 6.3.7 / 7.0.3 / 7.1.7 / 7.2.4; Crucible before 4.9.15; Fisheye before 4.9.15 | cpe:2.3:a:atlassian:bitbucket:*:*:*:*:data_center:*:*:*cpe:2.3:a:atlassian:confluence:*:*:*:*:data_center:*:*:*cpe:2.3:a:atlassian:jira_service_management:*:*:*:*:data_center:*:*:*cpe:2.3:a:atlassian:jira_software:*:*:*:*:data_center:*:*:*cpe:2.3:a:atlassian:bamboo:*:*:*:*:data_center:*:*:*cpe:2.3:a:atlassian:crowd:*:*:*:*:data_center:*:*:*cpe:2.3:a:atlassian:crucible:*:*:*:*:*:*:*:*cpe:2.3:a:atlassian:fisheye:*:*:*:*:*:*:*:* | CWE-552 |
Recommendations
- 01Patch on an Emergency BasisUpgrade every affected installation to a fixed version or later, outside your normal patch cycle. The fixed releases are Bitbucket Data Center 9.4.26 / 10.2.8 / 10.5.1, Confluence Data Center 9.2.26 / 10.2.19, Jira Service Management Data Center 5.12.40 / 10.3.26 / 11.3.12, Jira Software Data Center 9.12.40 / 10.3.26 / 11.3.12, Bamboo Data Center 10.2.24 / 12.1.12, Crowd Data Center 6.3.7 / 7.0.3 / 7.1.7 / 7.2.4, Crucible 4.9.15, and Fisheye 4.9.15.
- 02Take Exposed Instances Offline Until PatchedIf you cannot patch immediately, remove affected instances from the public internet or otherwise restrict them from external network access. Any instance reachable from the internet, even one that requires user authentication, should be walled off from external traffic until a fix or mitigation is in place.
- 03Apply Vendor Mitigations as a StopgapWhere patching must wait, apply Atlassian's mitigations, treating them as temporary rather than a substitute for patching. Options include a Web Application Firewall or proxy rule that blocks the vendor-supplied traversal regex across all affected products, a Tomcat RewriteValve rule for Confluence, Jira Service Management, Jira Software, Bamboo, and Crowd, and a separate
urlrewrite.xmlrule for Bitbucket. - 04Hunt for Evidence of CompromiseReview access logs even after patching. URL-decode each request line up to two passes and search for ".." immediately adjacent to "/", "\", or "::", or search raw log lines with Atlassian's provided regex. Block the attacker IP addresses observed in early exploitation (listed in the IoCs section) and investigate any requests matching the traversal pattern.
- 05Rotate Any Potentially Exposed SecretsIf investigation shows that protected configuration files such as
crowd.propertieswere accessed, rotate the exposed Crowd application credentials and any other secrets after the affected systems have been contained. Assume leaked credentials are compromised and reissue them rather than relying on the patch alone. - 06Harden Crowd IntegrationsEnforce Crowd's IP allowlisting so that leaked application credentials cannot be used to reach the Crowd service directly from arbitrary hosts. This significantly raises the bar on the most damaging part of the attack chain, the escalation from file read to Jira administrator.
Indicators of Compromise (IoCs)
| Type | Value |
|---|---|
| IPv4 | 38[.]60[.]157[.]86 146[.]70[.]187[.]234 159[.]26[.]119[.]225 |
MITRE ATT&CK TTPs
References & Patch Links
Patch links
References
What Next?
At Hive Pro, it is our mission to detect the most likely threats to your organization and to help you prevent them from happening.
.svg)